PLUGIN SECURITY
Is Wpdiscuz safe?
Advanced AJAX-powered WordPress comments plugin with live commenting, comment voting, inline feedback, social login, custom comment forms, and engagem …
What this plugin does
- Slug:
wpdiscuz - Author: AdvancedCoding
- 60000+ active installs
- 94/100 rating (578 reviews on wordpress.org)
- 4787497 all-time downloads
- On WordPress.org since 2014-11-30
ajax commentscomment formcommentslive commentswordpress comments
Maintenance status
- Latest known version: 7.6.63
- Last updated: 2026-08-27 1:56pm GMT
- Tested up to WordPress: 7.1
- Requires PHP: 7.4+
- Max supported PHP (analyzed): 8.4
Known vulnerabilities
38 known CVEs on file for Wpdiscuz.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-15032 | Comments – wpDiscuz [wpdiscuz] < 7.6.60 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Unknown | < 7.6.60 | 7.6.60 | 2026-08-03 | ✓ fixed in latest |
| CVE-2026-9148 | Comments – wpDiscuz [wpdiscuz] < 7.6.57 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.2 | < 7.6.57 | 7.6.57 | 2026-07-02 | ✓ fixed in latest |
| CVE-2026-22215 | Comments – wpDiscuz [wpdiscuz] < 7.6.47 | Cross-Site Request Forgery (CSRF) | Medium 5.4 | < 7.6.47 | 7.6.47 | 2026-03-13 | ✓ fixed in latest |
| CVE-2026-22210 | Comments – wpDiscuz [wpdiscuz] < 7.6.47 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 7.6.47 | 7.6.47 | 2026-03-13 | ✓ fixed in latest |
| CVE-2026-22216 | Comments – wpDiscuz [wpdiscuz] < 7.6.47 | Improper Control of Interaction Frequency | Medium 5.3 | < 7.6.47 | 7.6.47 | 2026-03-13 | ✓ fixed in latest |
| CVE-2026-22204 | Comments – wpDiscuz [wpdiscuz] < 7.6.47 | Improper Input Validation | Medium 5.3 | < 7.6.47 | 7.6.47 | 2026-03-13 | ✓ fixed in latest |
| CVE-2026-22203 | Comments – wpDiscuz [wpdiscuz] < 7.6.47 | Exposure of Sensitive Information to an Unauthorized Actor | Medium 4.9 | < 7.6.47 | 7.6.47 | 2026-03-13 | ✓ fixed in latest |
| CVE-2026-22202 | Comments – wpDiscuz [wpdiscuz] < 7.6.47 | Cross-Site Request Forgery (CSRF) | Medium 6.5 | < 7.6.47 | 7.6.47 | 2026-03-13 | ✓ fixed in latest |
+ 43 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-22182 | Comments – wpDiscuz [wpdiscuz] < 7.6.47 | Allocation of Resources Without Limits or Throttling | High 7.5 | < 7.6.47 | 7.6.47 | 2026-03-13 | ✓ fixed in latest |
| CVE-2026-22191 | Comments – wpDiscuz [wpdiscuz] < 7.6.47 | Improper Neutralization of Special Elements Used in a Template Engine | Medium 5.2 | < 7.6.47 | 7.6.47 | 2026-03-13 | ✓ fixed in latest |
| CVE-2026-22183 | Comments – wpDiscuz [wpdiscuz] < 7.6.47 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 7.6.47 | 7.6.47 | 2026-03-13 | ✓ fixed in latest |
| CVE-2026-22192 | Comments – wpDiscuz [wpdiscuz] < 7.6.47 | Missing Authentication for Critical Function | Critical 9.9 | < 7.6.47 | 7.6.47 | 2026-03-13 | ✓ fixed in latest |
| CVE-2026-22193 | Comments – wpDiscuz [wpdiscuz] < 7.6.47 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | High 7.5 | < 7.6.47 | 7.6.47 | 2026-03-13 | ✓ fixed in latest |
| CVE-2026-22199 | Comments – wpDiscuz [wpdiscuz] < 7.6.47 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | High 7.5 | < 7.6.47 | 7.6.47 | 2026-03-13 | ✓ fixed in latest |
| CVE-2026-22201 | Comments – wpDiscuz [wpdiscuz] < 7.6.47 | Use of Less Trusted Source | Medium 5.3 | < 7.6.47 | 7.6.47 | 2026-03-13 | ✓ fixed in latest |
| CVE-2026-22209 | Comments – wpDiscuz [wpdiscuz] < 7.6.47 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | Medium 5.5 | < 7.6.47 | 7.6.47 | 2026-03-12 | ✓ fixed in latest |
| CVE-2025-68997 | Comments – wpDiscuz [wpdiscuz] < 7.6.44 | Authorization Bypass Through User-Controlled Key | Medium 5.3 | < 7.6.44 | 7.6.44 | 2025-12-25 | ✓ fixed in latest |
| CVE-2025-13820 | Comments – wpDiscuz [wpdiscuz] < 7.6.40 | Improper Privilege Management | Medium 5.3 | < 7.6.40 | 7.6.40 | 2025-12-11 | ✓ fixed in latest |
| CVE-2024-9488 | Comments – wpDiscuz [wpdiscuz] < 7.6.25 | Authentication Bypass Using an Alternate Path or Channel | Critical 9.8 | < 7.6.25 | 7.6.25 | 2024-10-24 | ✓ fixed in latest |
| CVE-2024-6704 | Comments – wpDiscuz [wpdiscuz] < 7.6.22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 7.6.22 | 7.6.22 | 2024-08-01 | ✓ fixed in latest |
| CVE-2024-35681 | Comments – wpDiscuz [wpdiscuz] < 7.6.19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 7.6.19 | 7.6.19 | 2024-06-06 | ✓ fixed in latest |
| CVE-2024-2477 | Comments – wpDiscuz [wpdiscuz] < 7.6.16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 7.6.16 | 7.6.16 | 2024-04-22 | ✓ fixed in latest |
| CVE-2023-51691 | Comments – wpDiscuz [wpdiscuz] < 7.6.13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.9 | < 7.6.13 | 7.6.13 | 2023-11-17 | ✓ fixed in latest |
| CVE-2023-47775 | Comments – wpDiscuz [wpdiscuz] < 7.6.12 | Cross-Site Request Forgery (CSRF) | Medium 4.3 | < 7.6.12 | 7.6.12 | 2023-11-14 | ✓ fixed in latest |
| CVE-2023-47185 | Comments – wpDiscuz [wpdiscuz] < 7.6.12 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.1 | < 7.6.12 | 7.6.12 | 2023-10-31 | ✓ fixed in latest |
| CVE-2023-46310 | Comments – wpDiscuz [wpdiscuz] < 7.6.11 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) | Medium 5.3 | < 7.6.11 | 7.6.11 | 2023-10-22 | ✓ fixed in latest |
| CVE-2023-46311 | Comments – wpDiscuz [wpdiscuz] < 7.6.4 | Authorization Bypass Through User-Controlled Key | Low 2.7 | < 7.6.4 | 7.6.4 | 2023-10-22 | ✓ fixed in latest |
| CVE-2023-46309 | Comments – wpDiscuz [wpdiscuz] < 7.6.11 | Missing Authorization | Medium 5.3 | < 7.6.11 | 7.6.11 | 2023-10-20 | ✓ fixed in latest |
| CVE-2023-45760 | Comments – wpDiscuz [wpdiscuz] < 7.6.4 | Missing Authorization | Medium 4.3 | < 7.6.12 | 7.6.12 | 2023-10-12 | ✓ fixed in latest |
| — | Comments – wpDiscuz [wpdiscuz] < 7.6.6 | — | Unknown | < 7.6.6 | 7.6.6 | 2023-09-19 | ✓ fixed in latest |
| — | Comments – wpDiscuz [wpdiscuz] < 7.6.6 | — | Unknown | < 7.6.6 | 7.6.6 | 2023-09-18 | ✓ fixed in latest |
| CVE-2023-3869 | Comments – wpDiscuz [wpdiscuz] < 7.6.4 | Authorization Bypass Through User-Controlled Key | Medium 5.3 | < 7.6.4 | 7.6.4 | 2023-09-12 | ✓ fixed in latest |
| CVE-2023-3998 | Comments – wpDiscuz [wpdiscuz] < 7.6.4 | Authorization Bypass Through User-Controlled Key | Medium 5.3 | < 7.6.4 | 7.6.4 | 2023-09-12 | ✓ fixed in latest |
| CVE-2022-43492 | Comments – wpDiscuz [wpdiscuz] < 7.5 | Authorization Bypass Through User-Controlled Key | Medium 4.3 | < 7.5 | 7.5 | 2022-10-28 | ✓ fixed in latest |
| CVE-2022-23984 | Comments – wpDiscuz [wpdiscuz] < 7.3.12 | Exposure of Sensitive Information to an Unauthorized Actor | High 7.5 | < 7.3.12 | 7.3.12 | 2022-02-10 | ✓ fixed in latest |
| CVE-2021-24806 | Comments – wpDiscuz [wpdiscuz] < 7.3.4 | Cross-Site Request Forgery (CSRF) | Medium 4.3 | < 7.3.4 | 7.3.4 | 2021-10-11 | ✓ fixed in latest |
| CVE-2021-24737 | Comments – wpDiscuz [wpdiscuz] < 7.3.2 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.8 | < 7.3.2 | 7.3.2 | 2021-09-13 | ✓ fixed in latest |
| CVE-2020-24186 | Comments – wpDiscuz [wpdiscuz] >= 7.0 - <= 7.0.4 | Unrestricted Upload of File with Dangerous Type | Critical 10.0 | 7.0–7.0.5 | 7.0.5 | 2020-07-28 | ✓ fixed in latest |
| CVE-2020-13640 | Comments – wpDiscuz [wpdiscuz] < 5.3.6 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Critical 9.8 | < 5.3.6 | 5.3.6 | 2020-06-12 | ✓ fixed in latest |
| — | Comments – wpDiscuz [wpdiscuz] < 4.0.0 | — | Unknown | < 4.0.0 | 4.0.0 | 2017-06-20 | ✓ fixed in latest |
| — | Comments – wpDiscuz [wpdiscuz] < 3.1.5 | — | Unknown | < 3.1.5 | 3.1.5 | 2016-05-30 | ✓ fixed in latest |
| — | Comments – wpDiscuz [wpdiscuz] < 3.2.0 | — | Unknown | < 3.2.0 | 3.2.0 | 2016-05-30 | ✓ fixed in latest |
| — | Comments – wpDiscuz [wpdiscuz] < 7.6.34 | Missing Authorization | Medium 4.3 | < 7.6.34 | 7.6.34 | 0000-00-00 | ✓ fixed in latest |
| — | Comments – wpDiscuz [wpdiscuz] < 3.2.0 | — | Unknown | < 3.2.0 | 3.2.0 | — | ✓ fixed in latest |
| — | Comments – wpDiscuz [wpdiscuz] < 7.6.6 | — | Unknown | < 7.6.6 | 7.6.6 | — | ✓ fixed in latest |
| — | wpDiscuz < 3.2.0 - Reflected Cross-Site Scripting (XSS) | — | Unknown | < 3.2.0 | 3.2.0 | — | ✓ fixed in latest |
| CVE-2023-47185 | wpDiscuz < 7.6.12 - Unauthenticated Stored XSS | — | Unknown | < 7.6.12 | 7.6.12 | — | ✓ fixed in latest |
| — | wpDiscuz < 7.6.6 - Unauthenticated SQL Injection | — | Unknown | < 7.6.6 | 7.6.6 | — | ✓ fixed in latest |
| CVE-2023-46309 | wpDiscuz < 7.6.11 - Insufficient Authorization to Comment Submission on Deleted Posts | — | Unknown | < 7.6.11 | 7.6.11 | — | ✓ fixed in latest |
| CVE-2023-51691 | wpDiscuz < 7.6.13 - Admin+ Stored XSS | — | Unknown | < 7.6.13 | 7.6.13 | — | ✓ fixed in latest |
| CVE-2025-59591 | wpDiscuz < 7.6.34 - Missing Authorization | — | Unknown | < 7.6.34 | 7.6.34 | — | ✓ fixed in latest |
How to fix it
Keep Wpdiscuz updated — 7.6.63 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- AnyComment — 5000+ active installs — 96/100 (156) — max PHP <8.0
- No CAPTCHA reCAPTCHA — 4000+ active installs — 86/100 (69) — max PHP 8.4
- Advanced Comment Form — 4000+ active installs — 100/100 (19) — max PHP 8.4
- Comment Edit Core – Simple Comment Editing — 2000+ active installs — 96/100 (55)
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.