CVE-2024-53266

Discourse is an open source platform for community discussion. In affected versions with some combinations of plugins, and with CSP disabled, activity streams in the user's profile page may be vulnerable to XSS. This has been patched in the latest version of Discourse core. Users are advised to upgrade. Users unable to upgrade should ensure CSP is enabled.

• CWE-79

• https://github.com/discourse/discourse/security/advisories/GHSA-hw4j-4hg7-22h2Third Party Advisory

Published

Feb 4, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-5326The Post Grid Gutenberg Blocks and WordPress Blog Plugin – P…8.8
• CVE-2024-53260Autolab is a course management service that enables auto-gra…6.8
• CVE-2024-53261SvelteKit is a framework for rapidly developing robust, perf…5.4
• CVE-2024-53262SvelteKit is a framework for rapidly developing robust, perf…5.4
• CVE-2024-53263Git LFS is a Git extension for versioning large files. When …8.5
• CVE-2024-53264bunkerweb is an Open-source and next-generation Web Applicat…5.1
• CVE-2024-53267sigstore-java is a sigstore java client for interacting with…5.5
• CVE-2024-53268Joplin is an open source, privacy-focused note taking app wi…8.8
• CVE-2024-53269Envoy is a cloud-native high-performance edge/middle/service…7.5
• CVE-2024-5327The PowerPack Addons for Elementor (Free Widgets, Extensions…5.4
• CVE-2024-53270Envoy is a cloud-native high-performance edge/middle/service…7.5
• CVE-2024-53271Envoy is a cloud-native high-performance edge/middle/service…7.1