VulnTitan VulnTitan Security command center
Plugin Vulnerability Hub
Plugin 24 known issues Latest disclosed Dec 25, 2025

Comments – wpDiscuz Vulnerabilities

Review known vulnerability records for the WordPress plugin Comments – wpDiscuz (`wpdiscuz`), including severity, CVE references, affected versions, and patch status.

Recent tracked CVEs on this page include CVE-2025-68997, CVE-2025-13820 and CVE-2025-59591, so operators can jump from disclosure to patch validation without scanning the full feed first.

View on WordPress.org Back to Feed
Known Records
24
High or Critical
6
Patch Coverage
100%
Last Updated
Jan 20, 2026
Priority CVE Quick Links

Fast paths into Comments – wpDiscuz CVE reports

Start with the highest-signal CVE records for this WordPress plugin before scanning the full vulnerability feed.

Indexed CVEs
22
CVE-2024-9488 Critical 7.6.25
CVE-2024-9488 Comments – wpDiscuz Vulnerability

Comments – wpDiscuz <= 7.6.24 - Authentication Bypass via WordPress.com OAuth provider

CVE-2020-24186 Critical 7.0.5
CVE-2020-24186 Comments – wpDiscuz Remote Code Execution

Comments - wpDiscuz 7.0 - 7.0.4 - Unauthenticated Arbitrary File Upload leading to Remote Code Execution

CVE-2020-13640 Critical 5.3.6
CVE-2020-13640 Comments – wpDiscuz SQL Injection

Comments - wpDiscuz <= 5.3.5 - Blind SQL Injection via order Parameter

CVE-2025-13820 High 7.6.40
CVE-2025-13820 Comments – wpDiscuz Authorization Bypass

Comments – wpDiscuz <= 7.6.39 - Unauthenticated Authentication Bypass Through Account Takeover

CVE-2023-47185 High 7.6.12
CVE-2023-47185 Comments – wpDiscuz Stored Cross-Site Scripting

wpDiscuz <= 7.6.11 - Unauthenticated Stored Cross-Site Scripting via Comment Uploaded Image Filename

CVE-2024-35681 Medium 7.6.19
CVE-2024-35681 Comments – wpDiscuz Stored Cross-Site Scripting

Comments – wpDiscuz <= 7.6.18 - Authenticated (Contributor+) Stored Cross-Site Scripting

CVE-2024-2477 Medium 7.6.16
CVE-2024-2477 Comments – wpDiscuz Stored Cross-Site Scripting

wpDiscuz <= 7.6.15 - Authenticated (Author+) Stored Cross-Site Scripting via Uploaded Image Alternative Text

CVE-2023-45760 Medium 7.6.4
CVE-2023-45760 Comments – wpDiscuz Vulnerability

wpDiscuz <= 7.6.3 - Missing Authorization via AJAX actions

Coverage Snapshot

What this page helps you verify fast

This hub clusters every indexed record for Comments – wpDiscuz so operators can confirm whether a disclosed issue maps to the installed slug, version range, and patch path.

Patch Visibility
24 records include a published patch path, leaving 0 with no listed safe release yet.
Severity Mix
3 critical and 3 high severity findings.
Recent CVEs
CVE-2025-68997, CVE-2025-13820 and CVE-2025-59591
Reference Workflow
Jump from the hub into the full report when you need remediation notes, exploit context, CVSS vectors, or source references.
Triage First

Open the records most likely to drive action

These recent records surface the CVE strings, patch cues, and direct report links most operators need first.

Known Vulnerabilities

Reports for Comments – wpDiscuz

Sorted by latest disclosure date so newly published issues surface first.

Plugin Medium Patched: Yes CVE-2025-68997
CVE-2025-68997: wpDiscuz <= 7.6.42 - Unauthenticated Insecure Direct Object Reference

The Comments – wpDiscuz plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 7.6.42 due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to perform unauthorized actions.

Published
Dec 25, 2025
Patched Release
7.6.44
Affected Versions
Versions up to 7.6.42
Next Step
Update to 7.6.44 or newer if supported.
Open CVE-2025-68997 Report Open CVE Reference
Plugin High Patched: Yes CVE-2025-13820
CVE-2025-13820: Comments – wpDiscuz <= 7.6.39 - Unauthenticated Authentication Bypass Through Account Takeover

The Comments – wpDiscuz plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 7.6.39. This is due to the plugin not properly validating a user's identity through the disqus.com provider. This makes it possible for unauthenticated attack...

Published
Dec 11, 2025
Patched Release
7.6.40
Affected Versions
Versions up to 7.6.39
Next Step
Update to 7.6.40 or newer if supported.
Open CVE-2025-13820 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-59591
CVE-2025-59591: wpDiscuz <= 7.6.33 - Missing Authorization

The Comments – wpDiscuz plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 7.6.33. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform a...

Published
Sep 22, 2025
Patched Release
7.6.34
Affected Versions
Versions up to 7.6.33
Next Step
Update to 7.6.34 or newer if supported.
Open CVE-2025-59591 Report Open CVE Reference
Plugin Critical Patched: Yes CVE-2024-9488
CVE-2024-9488: Comments – wpDiscuz <= 7.6.24 - Authentication Bypass via WordPress.com OAuth provider

The Comments – wpDiscuz plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 7.6.24. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to...

Published
Oct 24, 2024
Patched Release
7.6.25
Affected Versions
Versions up to 7.6.24
Next Step
Update to 7.6.25 or newer if supported.
Open CVE-2024-9488 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-6704
CVE-2024-6704: Comments – wpDiscuz <= 7.6.21 - Unauthenticated HTML Injection

The Comments – wpDiscuz plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 7.6.21. This is due to a lack of filtering of HTML tags in comments. This makes it possible for unauthenticated attackers to add HTML such as hyperlinks to comments...

Published
Aug 01, 2024
Patched Release
7.6.22
Affected Versions
Versions up to 7.6.21
Next Step
Update to 7.6.22 or newer if supported.
Open CVE-2024-6704 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-35681
CVE-2024-35681: Comments – wpDiscuz <= 7.6.18 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Comments – wpDiscuz plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 7.6.18 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with...

Published
Jun 06, 2024
Patched Release
7.6.19
Affected Versions
Versions up to 7.6.18
Next Step
Update to 7.6.19 or newer if supported.
Open CVE-2024-35681 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-2477
CVE-2024-2477: wpDiscuz <= 7.6.15 - Authenticated (Author+) Stored Cross-Site Scripting via Uploaded Image Alternative Text

The wpDiscuz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Alternative Text' field of an uploaded image in all versions up to, and including, 7.6.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated a...

Published
Apr 22, 2024
Patched Release
7.6.16
Affected Versions
Versions up to 7.6.15
Next Step
Update to 7.6.16 or newer if supported.
Open CVE-2024-2477 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2023-51691
CVE-2023-51691: wpDiscuz <= 7.6.12 - Authenticated (Administrator+) Stored Cross-Site Scripting

The Comments – wpDiscuz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 7.6.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administr...

Published
Nov 17, 2023
Patched Release
7.6.13
Affected Versions
Versions up to 7.6.12
Next Step
Update to 7.6.13 or newer if supported.
Open CVE-2023-51691 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2023-47775
CVE-2023-47775: wpDiscuz <= 7.6.11 - Cross-Site Request Forgery

The wpDiscuz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 7.6.11. This is due to missing or incorrect nonce validation on one of its functions. This makes it possible for unauthenticated attackers to dismiss admin notices via...

Published
Nov 14, 2023
Patched Release
7.6.12
Affected Versions
Versions up to 7.6.11
Next Step
Update to 7.6.12 or newer if supported.
Open CVE-2023-47775 Report Open CVE Reference
Plugin High Patched: Yes CVE-2023-47185
CVE-2023-47185: wpDiscuz <= 7.6.11 - Unauthenticated Stored Cross-Site Scripting via Comment Uploaded Image Filename

The Comments – wpDiscuz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the filename of an image uploaded in a comment submission in all versions up to, and including, 7.6.11 due to insufficient input sanitization and output escaping. This makes it possible...

Published
Oct 31, 2023
Patched Release
7.6.12
Affected Versions
Versions up to 7.6.11
Next Step
Update to 7.6.12 or newer if supported.
Open CVE-2023-47185 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2023-46310
CVE-2023-46310: wpDiscuz <= 7.6.10 - Unauthenticated Content Injection

The wpDiscuz plugin for WordPress is vulnerable to Arbitrary Content Injection in versions up to, and including, 7.6.10. The cause of this vulnerability is undisclosed at this time. However, this vulnerability makes it possible for unauthenticated attackers to inject new content...

Published
Oct 22, 2023
Patched Release
7.6.11
Affected Versions
Versions up to 7.6.10
Next Step
Update to 7.6.11 or newer if supported.
Open CVE-2023-46310 Report Open CVE Reference
Plugin Low Patched: Yes CVE-2023-46311
CVE-2023-46311: wpDiscuz <= 7.6.3 - Authenticated(Author+) Insecure Direct Object Reference

The wpDiscuz plugin for WordPress is vulnerable to unauthorized modification of data due to a missing authorization check on an unknown function in versions up to, and including, 7.6.3. This makes it possible for authenticated attackers with author-level permissions and above to...

Published
Oct 22, 2023
Patched Release
7.6.4
Affected Versions
Versions up to 7.6.3
Next Step
Update to 7.6.4 or newer if supported.
Open CVE-2023-46311 Report Open CVE Reference