¿Es seguro Wpdiscuz?

Qué hace este plugin

• Slug: wpdiscuz
• 70000+ instalaciones activas

ajax commentscomment formcommentslive commentswordpress comments

Estado de mantenimiento

• Última versión conocida: 7.6.59
• Requiere PHP: 7.4+
• PHP máximo soportado (analizado): 8.4

Vulnerabilidades conocidas

36 CVEs conocidos registrados para Wpdiscuz.

CVE-2026-9148

The Comments – wpDiscuz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the guest commenter 'Website' field in versions up to, and including, 7.6.56 This is due to insufficient output escaping in the getCommentAuthor() function, which interpolates the stored comment_author_url value directly into single-quoted HTML attributes without applying esc_url() or esc_attr(). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2026-22215

wpDiscuz before 7.6.47 contains a cross-site request forgery vulnerability in the getFollowsPage() function that allows attackers to trigger unauthorized actions without nonce validation. Attackers can craft malicious requests to enumerate follow relationships and manipulate user follow data by exploiting the missing CSRF protection in the follows page handler.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2026-22210

wpDiscuz before 7.6.47 contains a cross-site scripting vulnerability that allows attackers to inject malicious code through unescaped attachment URLs in HTML output by exploiting the WpdiscuzHelperUpload class. Attackers can craft malicious attachment records or filter hooks to inject arbitrary JavaScript into img and anchor tag attributes, executing code in the context of WordPress users viewing comments.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2026-22209

wpDiscuz before 7.6.47 contains a cross-site scripting vulnerability in the customCss field that allows administrators to inject malicious scripts by breaking out of style tags. Attackers with admin access can inject payloads like </style><script>alert(1)</script> in the custom CSS setting to execute arbitrary JavaScript in user browsers.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2026-22216

wpDiscuz before 7.6.47 contains a missing rate limiting vulnerability that allows unauthenticated attackers to subscribe arbitrary email addresses to post notifications by sending POST requests to the wpdAddSubscription handler in class.WpdiscuzHelperAjax.php. Attackers can exploit LIKE wildcard characters in the subscription query to match multiple email addresses and generate unwanted notification emails to victim accounts.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2026-22204

wpDiscuz before 7.6.47 contains an email header injection vulnerability that allows attackers to manipulate mail recipients by injecting malicious data into the comment_author_email cookie. Attackers can craft a malicious cookie value that, when processed through urldecode() and passed to wp_mail() functions, enables header injection to alter email recipients or inject additional headers.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2026-22203

wpDiscuz before 7.6.47 contains an information disclosure vulnerability that allows administrators to inadvertently expose OAuth secrets by exporting plugin options as JSON. Attackers can obtain exported files containing plaintext API secrets like fbAppSecret, googleClientSecret, twitterAppSecret, and other social login credentials from support tickets, backups, or version control repositories.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2026-22202

wpDiscuz before 7.6.47 contains a cross-site request forgery vulnerability that allows attackers to delete all comments associated with an email address by crafting a malicious GET request with a valid HMAC key. Attackers can embed the deletecomments action URL in image tags or other resources to trigger permanent deletion of comments without user confirmation or POST-based CSRF protection.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

+ 39 vulnerabilidades conocidas más

CVE	Vulnerabilidad	Tipo	Gravedad	Afectadas	Corregido en	Publicado	Estado
CVE-2026-22182	Comments – wpDiscuz [wpdiscuz] < 7.6.47	Asignación de recursos sin límites ni control de tasa (throttling)	Alta 7,5	< 7.6.47	7.6.47	2026-03-13	✓ corregido en la última versión
CVE-2026-22191	Comments – wpDiscuz [wpdiscuz] < 7.6.47	Neutralización incorrecta de elementos especiales usados en un motor de plantillas (Server-Side Template Injection)	Media 5,2	< 7.6.47	7.6.47	2026-03-13	✓ corregido en la última versión
CVE-2026-22183	Comments – wpDiscuz [wpdiscuz] < 7.6.47	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 5,4	< 7.6.47	7.6.47	2026-03-13	✓ corregido en la última versión
CVE-2026-22192	Comments – wpDiscuz [wpdiscuz] < 7.6.47	Falta de autenticación en una función crítica	Crítica 9,9	< 7.6.47	7.6.47	2026-03-13	✓ corregido en la última versión
CVE-2026-22193	Comments – wpDiscuz [wpdiscuz] < 7.6.47	Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL)	Alta 7,5	< 7.6.47	7.6.47	2026-03-13	✓ corregido en la última versión
CVE-2026-22199	Comments – wpDiscuz [wpdiscuz] < 7.6.47	Limitación incorrecta de una ruta a un directorio restringido (Path Traversal)	Alta 7,5	< 7.6.47	7.6.47	2026-03-13	✓ corregido en la última versión
CVE-2026-22201	Comments – wpDiscuz [wpdiscuz] < 7.6.47	Uso de una fuente menos confiable	Media 5,3	< 7.6.47	7.6.47	2026-03-13	✓ corregido en la última versión
CVE-2025-68997	Comments – wpDiscuz [wpdiscuz] < 7.6.44	Elusión de autorización mediante una clave controlada por el usuario	Media 5,3	< 7.6.44	7.6.44	2025-12-25	✓ corregido en la última versión
CVE-2025-13820	Comments – wpDiscuz [wpdiscuz] < 7.6.40	Gestión incorrecta de privilegios	Media 5,3	< 7.6.40	7.6.40	2025-12-11	✓ corregido en la última versión
CVE-2024-9488	Comments – wpDiscuz [wpdiscuz] < 7.6.25	Elusión de autenticación mediante una ruta o canal alternativo	Crítica 9,8	< 7.6.25	7.6.25	2024-10-24	✓ corregido en la última versión
CVE-2024-6704	Comments – wpDiscuz [wpdiscuz] < 7.6.22	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 7.6.22	7.6.22	2024-08-01	✓ corregido en la última versión
CVE-2024-35681	Comments – wpDiscuz [wpdiscuz] < 7.6.19	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 5,4	< 7.6.19	7.6.19	2024-06-06	✓ corregido en la última versión
CVE-2024-2477	Comments – wpDiscuz [wpdiscuz] < 7.6.16	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 5,4	< 7.6.16	7.6.16	2024-04-22	✓ corregido en la última versión
CVE-2023-51691	Comments – wpDiscuz [wpdiscuz] < 7.6.13	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 5,9	< 7.6.13	7.6.13	2024-02-01	✓ corregido en la última versión
—	Comments – wpDiscuz [wpdiscuz] < 7.6.13	—	Desconocido	< 7.6.13	7.6.13	2023-11-17	✓ corregido en la última versión
CVE-2023-47775	Comments – wpDiscuz [wpdiscuz] < 7.6.12	Falsificación de petición en sitios cruzados (CSRF)	Media 4,3	< 7.6.12	7.6.12	2023-11-14	✓ corregido en la última versión
CVE-2023-47185	Comments – wpDiscuz [wpdiscuz] < 7.6.12	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Alta 7,1	< 7.6.12	7.6.12	2023-11-02	✓ corregido en la última versión
—	Comments – wpDiscuz [wpdiscuz] < 7.6.12	—	Desconocido	< 7.6.12	7.6.12	2023-10-31	✓ corregido en la última versión
CVE-2023-46309	Comments – wpDiscuz [wpdiscuz] < 7.6.11	Falta de control de autorización	Media 5,3	< 7.6.11	7.6.11	2023-10-22	✓ corregido en la última versión
CVE-2023-46310	Comments – wpDiscuz [wpdiscuz] < 7.6.11	Neutralización incorrecta de etiquetas HTML relacionadas con scripts en una página web (XSS básico)	Media 5,3	< 7.6.11	7.6.11	2023-10-22	✓ corregido en la última versión
CVE-2023-46311	Comments – wpDiscuz [wpdiscuz] < 7.6.4	Elusión de autorización mediante una clave controlada por el usuario	Baja 2,7	< 7.6.4	7.6.4	2023-10-22	✓ corregido en la última versión
—	Comments – wpDiscuz [wpdiscuz] < 7.6.11	—	Desconocido	< 7.6.11	7.6.11	2023-10-20	✓ corregido en la última versión
CVE-2023-45760	Comments – wpDiscuz [wpdiscuz] < 7.6.4	Falta de control de autorización	Media 4,3	< 7.6.4	7.6.4	2023-10-12	✓ corregido en la última versión
—	Comments – wpDiscuz [wpdiscuz] < 7.6.6	—	Desconocido	< 7.6.6	7.6.6	2023-09-19	✓ corregido en la última versión
—	Comments – wpDiscuz [wpdiscuz] < 7.6.6	—	Desconocido	< 7.6.6	7.6.6	2023-09-18	✓ corregido en la última versión
CVE-2023-3869	Comments – wpDiscuz [wpdiscuz] < 7.6.4	Elusión de autorización mediante una clave controlada por el usuario	Media 5,3	< 7.6.4	7.6.4	2023-09-12	✓ corregido en la última versión
CVE-2023-3998	Comments – wpDiscuz [wpdiscuz] < 7.6.4	Elusión de autorización mediante una clave controlada por el usuario	Media 5,3	< 7.6.4	7.6.4	2023-09-12	✓ corregido en la última versión
CVE-2022-43492	Comments – wpDiscuz [wpdiscuz] < 7.5	Elusión de autorización mediante una clave controlada por el usuario	Media 4,3	< 7.5	7.5	2022-10-28	✓ corregido en la última versión
CVE-2022-23984	Comments – wpDiscuz [wpdiscuz] < 7.3.12	Exposición de información sensible a un actor no autorizado	Alta 7,5	< 7.3.12	7.3.12	2022-02-10	✓ corregido en la última versión
CVE-2021-24806	Comments – wpDiscuz [wpdiscuz] < 7.3.4	Falsificación de petición en sitios cruzados (CSRF)	Media 4,3	< 7.3.4	7.3.4	2021-10-11	✓ corregido en la última versión
CVE-2021-24737	Comments – wpDiscuz [wpdiscuz] < 7.3.2	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 4,8	< 7.3.2	7.3.2	2021-09-13	✓ corregido en la última versión
CVE-2020-24186	Comments – wpDiscuz [wpdiscuz] >= 7.0 - <= 7.0.4	Carga de archivos sin restricción de tipo peligroso	Crítica 10,0	7.0–7.0.4	7.0.4	2020-07-28	✓ corregido en la última versión
CVE-2020-13640	Comments – wpDiscuz [wpdiscuz] < 5.3.6	Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL)	Crítica 9,8	< 5.3.6	5.3.6	2020-06-12	✓ corregido en la última versión
—	Comments – wpDiscuz [wpdiscuz] < 4.0.0	—	Desconocido	< 4.0.0	4.0.0	2017-06-20	✓ corregido en la última versión
—	Comments – wpDiscuz [wpdiscuz] < 3.1.5	—	Desconocido	< 3.1.5	3.1.5	2016-05-30	✓ corregido en la última versión
—	Comments – wpDiscuz [wpdiscuz] < 3.2.0	—	Desconocido	< 3.2.0	3.2.0	2016-05-30	✓ corregido en la última versión
—	Comments – wpDiscuz [wpdiscuz] < 7.6.34	Falta de control de autorización	Media 4,3	< 7.6.34	7.6.34	0000-00-00	✓ corregido en la última versión
—	Comments – wpDiscuz [wpdiscuz] < 3.2.0	—	Desconocido	< 3.2.0	3.2.0	—	✓ corregido en la última versión
—	Comments – wpDiscuz [wpdiscuz] < 7.6.6	—	Desconocido	< 7.6.6	7.6.6	—	✓ corregido en la última versión

CVE-2026-22182

wpDiscuz before 7.6.47 contains an unauthenticated denial of service vulnerability that allows anonymous users to trigger mass notification emails by exploiting the checkNotificationType() function. Attackers can repeatedly call the wpdiscuz-ajax.php endpoint with arbitrary postId and comment_id parameters to flood subscribers with notifications, as the handler lacks nonce verification, authentication checks, and rate limiting.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2026-22191

Beghelli Sicuro24 SicuroWeb contains a template injection vulnerability that allows attackers to inject arbitrary AngularJS expressions by exploiting improper rendering of untrusted input in AngularJS template contexts. Attackers can inject malicious expressions that are compiled and executed by the AngularJS 1.5.2 runtime to achieve arbitrary JavaScript execution in operator browser sessions, with network-adjacent attackers able to deliver payloads via MITM injection in plaintext HTTP deployments.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2026-22183

wpDiscuz before 7.6.47 contains a stored cross-site scripting vulnerability in the inline comment preview functionality that allows authenticated users to inject malicious scripts by submitting comments with unescaped content. Attackers with unfiltered_html capabilities can inject JavaScript directly through comment content rendered in the AJAX response from the getLastInlineComments() function in class.WpdiscuzHelperAjax.php without proper HTML escaping.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2026-22192

Voltronic Power SNMP Web Pro version 1.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to access privileged management functions by manipulating browser localStorage values. Attackers can modify client-side authentication state to bypass server-side access controls and gain unauthorized access to protected management functionality without valid credentials.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2026-22193

wpDiscuz before 7.6.47 contains an SQL injection vulnerability in the getAllSubscriptions() function where string parameters lack proper quote escaping in SQL queries. Attackers can inject malicious SQL code through email, activation_key, subscription_date, and imported_from parameters to manipulate database queries and extract sensitive information.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2026-22199

Voltronic Power SNMP Web Pro version 1.1 contains a pre-authentication path traversal vulnerability in the upload.cgi endpoint that allows unauthenticated attackers to read arbitrary files on the device filesystem by supplying directory traversal sequences in the params parameter. Attackers can exploit this vulnerability to disclose sensitive files such as password hashes, which can be cracked offline to obtain root-level access and enable full system compromise.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2026-22201

wpDiscuz before 7.6.47 contains an IP spoofing vulnerability in the getIP() function that allows attackers to bypass IP-based rate limiting and ban enforcement by trusting untrusted HTTP headers. Attackers can set HTTP_CLIENT_IP or HTTP_X_FORWARDED_FOR headers to spoof their IP address and circumvent security controls.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2025-68997

The Comments – wpDiscuz plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 7.6.42 due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to perform unauthorized actions.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2025-13820

The Comments – wpDiscuz plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 7.6.39. This is due to the plugin not properly validating a user's identity through the disqus.com provider. This makes it possible for unauthenticated attackers to authenticate as other users if they have not set up disqus.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2024-9488

The Comments – wpDiscuz plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 7.6.24. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email and the user does not have an already-existing account for the service returning the token.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-6704

The Comments – wpDiscuz plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 7.6.21. This is due to a lack of filtering of HTML tags in comments. This makes it possible for unauthenticated attackers to add HTML such as hyperlinks to comments when rich editing is disabled.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-35681

The Comments – wpDiscuz plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 7.6.18 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2024-2477

The wpDiscuz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Alternative Text' field of an uploaded image in all versions up to, and including, 7.6.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2023-51691

Update the WordPress wpDiscuz plugin to the latest available version (at least 7.6.13). Jeongwoo-Lee(Roronoa) discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress wpDiscuz Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 7.6.13. Have additional information or questions about this entry? Get in touch.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Comments – wpDiscuz [wpdiscuz] < 7.6.13

The Comments – wpDiscuz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 7.6.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2023-47775

The wpDiscuz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 7.6.11. This is due to missing or incorrect nonce validation on one of its functions. This makes it possible for unauthenticated attackers to dismiss admin notices via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2023-47185

Update the WordPress wpDiscuz plugin to the latest available version (at least 7.6.12). FearZzZz discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress wpDiscuz Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 7.6.12.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Comments – wpDiscuz [wpdiscuz] < 7.6.12

The Comments – wpDiscuz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the filename of an image uploaded in a comment submission in all versions up to, and including, 7.6.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2023-46309

Update the WordPress wpDiscuz plugin to the latest available version (at least 7.6.11). Revan Arifio discovered and reported this Broken Access Control vulnerability in WordPress wpDiscuz Plugin. A broken access control issue refers to a missing authorization, authentication or nonce token check in a function that could lead to an unprivileged user to executing a certain higher privileged action. This vulnerability has been fixed in version 7.6.11.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2023-46310

Update the WordPress wpDiscuz plugin to the latest available version (at least 7.6.11). Revan Arifio discovered and reported this Content Injection vulnerability in WordPress wpDiscuz Plugin. This could allow a malicious actor to inject their own content into pages and posts of your website. This could also be abused to inject phishing pages into your website. This vulnerability has been fixed in version 7.6.11.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2023-46311

Update the WordPress wpDiscuz plugin to the latest available version (at least 7.6.4). Revan Arifio discovered and reported this Insecure Direct Object References (IDOR) vulnerability in WordPress wpDiscuz Plugin. An insecure direct object reference vulnerability could allow a malicious actor to bypass authorization, authentication, access sensitive files/folders or interact with the database. This vulnerability has been fixed in version 7.6.4.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Comments – wpDiscuz [wpdiscuz] < 7.6.11

The Comments – wpDiscuz plugin for WordPress is vulnerable to unauthorized modification of data due to insufficient validation on the comment functionality in all versions up to, and including, 7.6.10. This makes it possible for unauthenticated attackers to leave comments on trashed posts.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2023-45760

Update the WordPress wpDiscuz plugin to the latest available version (at least 7.6.4). FearZzZz discovered and reported this Broken Access Control vulnerability in WordPress wpDiscuz Plugin. A broken access control issue refers to a missing authorization, authentication or nonce token check in a function that could lead to an unprivileged user to executing a certain higher privileged action. This vulnerability has been fixed in version 7.6.4.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Comments – wpDiscuz [wpdiscuz] < 7.6.6

Update the WordPress wpDiscuz plugin to the latest available version (at least 7.6.6). Unknown discovered and reported this SQL Injection vulnerability in WordPress wpDiscuz Plugin. This could allow a malicious actor to directly interact with your database, including but not limited to stealing information. This vulnerability has been fixed in version 7.6.6.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Comments – wpDiscuz [wpdiscuz] < 7.6.6

The wpDiscuz plugin for WordPress is vulnerable to SQL Injection via the 'visibleCommentIds' parameter in versions up to, and including, 7.6.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This requires the 'Live Update' functionality to be enabled for subscriber+ exploitation, and the 'Enable Live Update for Guests' setting enabled for unauthenticated exploitation.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2023-3869

Update the WordPress wpDiscuz plugin to the latest available version (at least 7.6.4). FearZzZz discovered and reported this Insecure Direct Object References (IDOR) vulnerability in WordPress wpDiscuz Plugin. An insecure direct object reference vulnerability could allow a malicious actor to bypass authorization, authentication, access sensitive files/folders or interact with the database. This vulnerability has been fixed in version 7.6.4.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2023-3998

Update the WordPress wpDiscuz plugin to the latest available version (at least 7.6.4). FearZzZz discovered and reported this Insecure Direct Object References (IDOR) vulnerability in WordPress wpDiscuz Plugin. An insecure direct object reference vulnerability could allow a malicious actor to bypass authorization, authentication, access sensitive files/folders or interact with the database. This vulnerability has been fixed in version 7.6.4.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2022-43492

The Comments – wpDiscuz plugin for WordPress is vulnerable to insecure direct object reference in versions up to, and including, 7.4.2. This is due to insufficient validation on the 'wmu_attachments' user-controlled key. This makes it possible for authenticated attackers with subscriber-level capabilities and above to inject attachments that do not belong to them into post comments.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2022-23984

Sensitive Information Disclosure vulnerability discovered in WordPress wpDiscuz plugin (versions <= 7.3.11) by Muhammad Daffa.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2021-24806

The plugin does check for CSRF when adding, editing and deleting comments, which could allow attacker to make logged in users such as admin edit and delete arbitrary comment, or the user who made the comment to edit it via a CSRF attack. Attackers could also make logged in users post arbitrary comment. Other affected actions: wpdCloseThread (to close/open threads), wpdStickComment (to stick/unstick a comment)

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

CVE-2021-24737

The plugin does not properly sanitise or escape the Follow and Unfollow messages before outputting them in the page, which could allow high privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Timeline: May 18th, 2021 - Vendor contacted by email, not a security issue according to them but will filter in the next update. September 7th, 2021 - v7.3.0 released, issue still present September 13th, 2021 - Escalated to WP Plugins Team & Public Disclosure. v7.3.1 released, issue still present. September 19th, 2021 - v7.3.2 released, fixing the issue when settings are saved again (so any existing payloads will still work until settings are saved with this new version installed)

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

CVE-2020-24186

A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allows unauthenticated users to upload any type of file, including PHP files via the wmuUploadFiles AJAX action.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2020-13640

A SQL injection issue in the gVectors wpDiscuz plugin 5.3.5 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the order parameter of a wpdLoadMoreComments request. (No 7.x versions are affected.)

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

Comments – wpDiscuz [wpdiscuz] < 4.0.0

Cross-Site Request Forgery (CSRF) Vulnerability was found in WordPress wpDiscuz plugin in 3.2.8 version. There's no nonce check when resetting the plugins settings. Update the plugin.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Comments – wpDiscuz [wpdiscuz] < 3.1.5

This plugin is prone to a reflected cross site scripting vulnerability, because "Content-Type: application/json" is not set. Update the plugin.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Comments – wpDiscuz [wpdiscuz] < 3.2.0

The Comments - wpDiscuz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘message’ parameter in versions up to, and including, 3.1.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Comments – wpDiscuz [wpdiscuz] < 7.6.34

The Comments – wpDiscuz plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 7.6.33. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Comments – wpDiscuz [wpdiscuz] < 3.2.0

The Comments – wpDiscuz WordPress plugin was affected by a Reflected Cross-Site Scripting (XSS) security vulnerability.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

Comments – wpDiscuz [wpdiscuz] < 7.6.6

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

Cómo solucionarlo

Mantén Wpdiscuz actualizado — 7.6.59 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").

Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.

Alternativas más seguras / más establecidas

• AnyComment — 5000+ instalaciones activas — 96/100 (156) — PHP máx. <8.0
• No CAPTCHA reCAPTCHA — 4000+ instalaciones activas — 86/100 (69) — PHP máx. 8.4
• Advanced Comment Form — 4000+ instalaciones activas — 100/100 (19) — PHP máx. 8.4
• Comment Edit Core – Simple Comment Editing — 2000+ instalaciones activas — 96/100 (55)
• Power Captcha reCAPTCHA — 1000+ instalaciones activas — 100/100 (3)