{"metadata": {"vulnerability": "CVE-2026-9148", "count": 18, "kinds": {"milestone": 4, "sighting": 4, "kev": 0, "other": 10}}, "data": [{"timestamp": "2026-05-20T21:18:38.233Z", "date_only": false, "value": "2026-05-20T21:18:38.233Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-9148", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-05-20T21:33:50Z", "date_only": false, "value": "2026-05-20T21:33:50.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-9148", "field": "containers.cna.timeline.0.time"}, {"timestamp": "2026-07-02T17:39:38Z", "date_only": false, "value": "2026-07-02T17:39:38.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-9148", "field": "containers.cna.timeline.1.time"}, {"timestamp": "2026-07-03T06:50:12.154Z", "date_only": false, "value": "2026-07-03T06:50:12.154Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-9148", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-07-03T06:50:12.154Z", "date_only": false, "value": "2026-07-03T06:50:12.154Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-9148", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-07-03T08:16:25Z", "date_only": false, "value": "2026-07-03T08:16:25Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-MH45-HP98-PCH7", "record": "GHSA-MH45-HP98-PCH7", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-07-03T08:16:25.367Z", "date_only": false, "value": "2026-07-03T08:16:25.367", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-9148", "record": "FKIE_CVE-2026-9148", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-07-03T09:31:28Z", "date_only": false, "value": "2026-07-03T09:31:28Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-MH45-HP98-PCH7", "record": "GHSA-MH45-HP98-PCH7", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-07-03T09:31:28Z", "date_only": false, "value": "2026-07-03T09:31:28Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-MH45-HP98-PCH7", "record": "GHSA-MH45-HP98-PCH7", "field": "modified", "linked_record": true}, {"timestamp": "2026-07-03T09:51:21.611Z", "date_only": false, "value": "2026-07-03T09:51:21.611129Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mpqbiygs5w2n", "record": "CVE-2026-9148", "field": "creation_timestamp", "uuid": "ad26b638-df66-4a8b-9665-9a5fc0437e6f", "content": "CVE-2026-9148 - Comments\nCVE ID : CVE-2026-9148\n \n Published : July 3, 2026, 6:50 a.m. | 2\u00a0hours, 57\u00a0minutes ago\n \n Description : The Comments \u2013 wpDiscuz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the guest commenter 'Website' field in versions up to...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/3mpqbiygs5w2n"}, {"timestamp": "2026-07-03T18:16:07.474Z", "date_only": false, "value": "2026-07-03T18:16:07.474272Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/atomicedge.bsky.social/post/3mpr5plilnz2m", "record": "CVE-2026-9148", "field": "creation_timestamp", "uuid": "83d164e5-5e2c-4f63-a721-6b52a69b1e0a", "content": "CVE-2026-9148 wpdiscuz (CVSS Score 7.2) \n\n#WordPress plugin #vulnerability #cybersecurity #wordpressfirewall #hacking #wpsecurity #atomicedge #cybersecurity #malware #vulnerabilityresearch #cve #redteam #proofofconcept", "url": "https://bsky.app/profile/atomicedge.bsky.social/post/3mpr5plilnz2m"}, {"timestamp": "2026-07-03T22:36:52.034Z", "date_only": false, "value": "2026-07-03T22:36:52.034519Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mprmbsnnoe2y", "record": "CVE-2026-9148", "field": "creation_timestamp", "uuid": "06e54c53-770a-46fc-b2cd-70607c2a3bad", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-9148 \u0432 \u043f\u043b\u0430\u0433\u0438\u043d\u0435 wpDiscuz: \u0443\u0433\u0440\u043e\u0437\u0430 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u043d\u0430 WordPress\n\n\n\nhttps://kripta.biz/posts/EA7CB820-253D-48CB-BE88-EAD2760097EB", "url": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mprmbsnnoe2y"}, {"timestamp": "2026-07-05T00:00:40.706Z", "date_only": false, "value": "2026-07-05T00:00:40.706883Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pulse-wp.com/post/3mpubgmlrvk2r", "record": "CVE-2026-9148", "field": "creation_timestamp", "uuid": "ac06e1dc-13e9-4218-8271-ac92d0191de4", "content": "CVE-2026-9148. wpDiscuz up to 7.6.56. Stored XSS via website field. Attacker injects malicious code. Runs on every page load. Steals admin sessions. No patch available. Disable the plugin now.\n\nScan: pulse-wp.com\n#WordPress #XSS #CyberSecurity", "url": "https://bsky.app/profile/pulse-wp.com/post/3mpubgmlrvk2r"}, {"timestamp": "2026-07-06T15:32:09.582Z", "date_only": false, "value": "2026-07-06T15:32:09.582881Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-9148", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-07-06T15:32:09.582Z", "date_only": false, "value": "2026-07-06T15:32:09.582881Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-9148", "record": "FKIE_CVE-2026-9148", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-07-06T15:32:18.602Z", "date_only": false, "value": "2026-07-06T15:32:18.602Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-9148", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-07-06T15:32:18.602Z", "date_only": false, "value": "2026-07-06T15:32:18.602Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-9148", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-07-06T18:02:49.450Z", "date_only": false, "value": "2026-07-06T18:02:49.450", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-9148", "record": "FKIE_CVE-2026-9148", "field": "lastModified", "linked_record": true}], "metrics": {"as_of": "2026-11-03T23:49:12.102Z", "anchors": {"origin": {"timestamp": "2026-07-03T06:50:12.154Z", "date_only": false, "value": "2026-07-03T06:50:12.154Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-9148", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-07-03T06:50:12.154Z", "date_only": false, "value": "2026-07-03T06:50:12.154Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-9148", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 10688339.948481, "hours": 2968.9833190225, "days": 123.70763829260416, "min_seconds": 10688339.948481, "max_seconds": 10688339.948481, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-07-03T06:50:12.154Z", "date_only": false, "value": "2026-07-03T06:50:12.154Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-9148", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-03T23:49:12.102Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}