CVE-2024-31219: Discourse Discourse-Reactions

Medium severity, CVSS 4.3. EPSS: 0.4% chance of exploitation in the next 30 days.

Discourse-reactions is a plugin that allows user to add their reactions to the post. When whispers are enabled on a site via `whispers_allowed_groups` and reactions are made on whispers on public topics, the contents of the whisper and the reaction data are shown on the `/u/:username/activity/reactions` endpoint.

Affected products

• Discourse Discourse-Reactions: before 0.5 (fixed in 0.5)

Published 2024-04-15. Last modified 2026-06-17.