Our news and updates

In Discourse versions 3.3.3 and prior on the `stable` branch and 3.4.0.beta3 and prior on the `beta` and `tests-passed` branches a medium severity vulnerability CVE-2024-56328 was detected. This vulnerability allows attackers to post malicious links that can execute harmful code in users’ browsers if Content Security Policy protection is disabled on the site. To fix this issue, users should upgrade Discourse to versions 3.3.4 and later on the `stable` branch or version 3.4.0.beta4 and later on the `beta` and `tests-passed` branches. For more details, visit https://nvd.nist.gov/vuln/detail/cve-2024-56328.

In Discourse versions 3.3.3 and prior on the `stable` branch and 3.4.0.beta4 and prior on the `beta` and `tests-passed` branches a medium severity vulnerability CVE-2024-56197 was detected. This vulnerability allows attackers to read the titles and metadata of private messages if the “PM tags allowed for groups” option is enabled and the attacker is a member of a group included in that list. To fix this issue, users should upgrade Discourse to version 3.3.4 and later on the `stable` branch or version 3.4.0.beta5 and later on the `beta` and `tests-passed` branches. For more details, visit https://nvd.nist.gov/vuln/detail/cve-2024-56197.

In Discourse versions prior to 3.3.2 on the `stable` branch and prior to 3.4.0.beta3 on the `tests-passed` branch a high severity vulnerability CVE-2024-55948 was detected. This vulnerability allows attackers to craft XHR requests that poison the anonymous cache, potentially serving responses with missing preloaded data to anonymous visitors. To address this issue, users should upgrade Discourse to versions 3.3.2 and later on the `stable` branch or version 3.4.0.beta3 and later on the` tests-passed` branches. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-55948.

In Discourse versions 3.4.0.beta3 and prior on the `beta` and `tests-passed` branches a low severity vulnerability CVE-2025-22601 was detected. This vulnerability allows attackers to trick users into changing their own username via a crafted link using the `activate-account` route. To address this issue, users should upgrade Discourse to version 3.4.0.beta4 on the `beta` and `tests-passed` branches or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-22601.

In Discourse versions 3.3.2 and prior on the `stable` branch and 3.4.0.beta3 and prior on the `beta` and `tests-passed` branches a medium severity vulnerability CVE-2024-53994 was detected. This vulnerability allows users who disable chat in preferences to still be reachable in some cases. To address this issue, users should upgrade Discourse to version 3.3.3 and later on the `stable` branch or version 3.4.0.beta4 and later on the `beta` and `tests-passed` branches. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-53994.

In Discourse versions prior to 3.3.2 on the `stable` branch and 3.4.0.beta3 on the `tests-passed` branch a high severity vulnerability CVE-2025-23023 was detected. This vulnerability allows attackers to poison the anonymous cache by crafting a request with specific headers, potentially leading to missing preloaded data in the cache. This issue affects only anonymous visitors to the site. To address this issue, users should upgrade to the latest version of Discourse. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-23023.

In Discourse versions 3.3.3 and prior on the `stable` branch and 3.4.0.beta3 and prior on the `beta` and `tests-passed` branches a medium severity vulnerability CVE-2025-22602 was detected. This vulnerability allows attackers to execute arbitrary JavaScript on users’ browsers by posting a malicious video placeholder HTML element. To address this issue, users should upgrade Discourse to version 3.3.4 on the `stable` branch or version 3.4.0.beta4 on the `beta` and `tests-passed` branches. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-22602.

In WooCommerce Wishlist versions before 1.8.8 a high severity vulnerability CVE-2024-13694 was detected. This vulnerability allows unauthenticated attackers to extract data from wishlists they should not have access to, due to missing validation on a user-controlled key in the download_pdf_file() function. To address this issue, users should upgrade to version 1.8.8 or later. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-13694.

In MySQL Server versions up to 9.1.0 a medium severity vulnerability CVE-2025-21567 was detected. This vulnerability allows a low-privileged attacker with network access via multiple protocols to compromise MySQL Server. To address this issue, users should upgrade to a version 9.2.0 or higher. For more details, visit https://avd.aquasec.com/nvd/2025/cve-2025-21567.