Unknown Comments vulnerabilities

• markjaquith subscribe to comments Subscribe to Comments 2.3 - 2.3.2 - Author+ Email Header Injection via From Name Setting CVE-2026-91831 3.8 LowOctober 19, 2026
• markjaquith subscribe to comments Subscribe to Comments < 2.3.3 - Unauthenticated Subscription Management Key Disclosure via Forged Comment Cookie CVE-2026-91830 6.5 MediumOctober 16, 2026
• markjaquith subscribe to comments Subscribe to Comments < 2.3.3 - Reflected XSS via 'ref' Parameter CVE-2026-91829 7.1 HighOctober 11, 2026
• unknown comments import & export Comments Import & Export 2.1.11 - 2.5.3 - Author+ Comment PII Disclosure via Export CVE-2026-87836 2.7 LowSeptember 17, 2026
• unknown ajaxify comments Ajaxify Comments < 3.2 - Unauthenticated HTTP Header Injection CVE-2026-2811 5.4 MediumSeptember 2, 2026
• unknown comments Comments – wpDiscuz < 7.6.66 - Unauthenticated Comment Disclosure via SQLi CVE-2026-19704 5.3 MediumSeptember 2, 2026
• unknown comments wpDiscuz < 7.6.60 - Unauthenticated Stored XSS via Image URL Conversion CVE-2026-15032 6.1 MediumAugust 7, 2026
• unknown decent comments Decent Comments < 3.0.2 - Unauthenticated Email Address Disclosure CVE-2026-7385 5.8 MediumMay 20, 2026
• unknown comments Comments – wpDiscuz < 7.6.40 - Unauthenticated Account Takeover CVE-2025-13820 5.3 MediumJanuary 1, 2026
• abitgone commentsafe, unknown abitgone commentsafe +1 more aBitGone CommentSafe <= 1.0.0 - Settings Update to Stored XSS via CSRF CVE-2023-7174 7.1 HighMay 15, 2025
• top comments project comments, unknown top comments +1 more Top Comments <= 1.0 - Admin+ Stored Cross-Site Scripting CVE-2024-12874 4.8 MediumMay 15, 2025
• unknown better comments Better Comments < 1.5.6 - Subscriber+ Stored XSS CVE-2024-2404 5.4 MediumApril 24, 2024
• unknown better comments Better Comments < 1.5.6 - Admin+ Stored XSS CVE-2024-2402 5.4 MediumApril 24, 2024
• heateor super socializer, unknown social share, social login and social comments plugin +1 more Super Socializer < 7.13.64 - Editor+ Stored XSS CVE-2024-2836 4.8 MediumApril 15, 2024
• heator social share\, social login and social comments, unknown social share, social login and social comments plugin +1 more Super Socializer < 7.13.52 - Reflected XSS CVE-2023-2779 Public exploit 6.1 MediumJune 19, 2023
• trumani stop spammers, unknown stop spammers security | block spam users, comments, forms +1 more Stop Spammers Security < 2023 - Admin+ Stored XSS CVE-2023-2489 4.8 MediumJune 5, 2023
• trumani stop spammers, unknown stop spammers security | block spam users, comments, forms +1 more Stop Spammers Security < 2023 - Reflected XSS CVE-2023-2488 6.1 MediumJune 5, 2023
• appjetty show all comments Show All Comments < 7.0.1 - Reflected XSS CVE-2022-4295 6.1 MediumJanuary 16, 2023
• heateor super socializer, unknown social share, social login and social comments plugin +1 more Super Socializer < 7.13.44 - Contributor+ Stored XSS CVE-2022-4484 5.4 MediumJanuary 16, 2023
• trumani stop spammers, unknown stop spammers security | block spam users, comments, forms +1 more Stop Spammers Security < 2022.6 - Unauthenticated PHP Object Injection CVE-2022-4120 EPSS 18.1% 9.8 CriticalDecember 26, 2022
• add comments project comments, unknown add comments +1 more Add Comments <= 1.0.1 - Admin+ Stored XSS CVE-2022-3909 4.8 MediumDecember 5, 2022
• stop spam comments project spam comments, unknown stop spam comments +1 more Stop Spam Comments <= 0.2.1.2 - Access Token Bypass CVE-2022-1663 6.5 MediumAugust 29, 2022
• najeebmedia wordpress comments fields WP Comments Fields < 4.1 - Admin+ Stored Cross-Site Scripting CVE-2022-2398 4.8 MediumAugust 8, 2022
• turn off all comments project off all comments, unknown turn off all comments +1 more Turn off all comments <= 1.0 - Reflected Cross-Site Scripting CVE-2022-1192 6.1 MediumMay 23, 2022
• unknown social comments by wpdevart, wpdevart social comments +1 more Social comments by WpDevArt < 2.5.0 - Admin+ Stored Cross-Site Scripting CVE-2022-0876 4.8 MediumApril 25, 2022
• unknown good & bad comments, good-bad-comments project good-bad-comments +1 more Good & Bad Comments <= 1.0.0 - Admin+ Stored Cross-Site Scripting CVE-2022-1090 4.8 MediumApril 18, 2022
• heateor super socializer, the champ social share, social login and social comments plugin – super socializer +1 more Super Socializer < 7.13.30 - Reflected Cross-Site Scripting CVE-2021-24987 6.1 MediumApril 11, 2022
• gvectors wpdiscuz, advancedcoding comments – wpdiscuz +1 more wpDiscuz < 7.3.4 - Arbitrary Comment Addition/Edition/Deletion via CSRF CVE-2021-24806 4.3 MediumNovember 8, 2021
• delete all comments easily project all comments easily, unknown delete all comments easily +1 more Delete All Comments Easily <= 1.3 - All Comments Deletion via CSRF CVE-2020-36505 6.5 MediumNovember 1, 2021
• advancedcoding comments – wpdiscuz, gvectors wpdiscuz +1 more Comments - wpDiscuz <= 7.3.0 - Admin+ Stored Cross-Site Scripting CVE-2021-24737 4.8 MediumOctober 11, 2021
• trumani stop spammers, unknown stop spammers security | block spam users, comments, forms +1 more Stop Spammers Security < 2021.18 - Authenticated Stored XSS CVE-2021-24517 5.4 MediumSeptember 6, 2021
• edit comments project comments, unknown edit comments +1 more Edit Comments <= 0.3 - Unauthenticated SQL Injection CVE-2021-24551 9.8 CriticalAugust 23, 2021
• unknown comments like dislike Comments Like Dislike < 1.1.4 - Add Like/Dislike Bypass CVE-2021-24379 5.3 MediumJune 21, 2021