Comments – wpDiscuz

Information

Software Type Plugin
Software Slug wpdiscuz (view on wordpress.org)
Software Status Active
Software Author advancedcoding
Software Website wpdiscuz.com
Software Downloads 3,358,478
Software Active Installs 80,000
Software Record Last Updated June 25, 2024

19 Vulnerabilities

8.8
CVE ID Unknown
Sep 18, 2023
Researchers:
Title Status CVE ID CVSS Researchers Date
Comments – wpDiscuz <= 7.6.18 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2024-35681 6.4 LVT-tholv2k June 6, 2024
wpDiscuz <= 7.6.15 - Authenticated (Author+) Stored Cross-Site Scripting via Uploaded Image Alternative Text Patched CVE-2024-2477 6.4 Ngô Thiên An (ancorn_) April 22, 2024
wpDiscuz <= 7.6.12 - Authenticated (Administrator+) Stored Cross-Site Scripting Patched CVE-2023-51691 4.4 Jeongwoo-Lee(Roronoa) November 17, 2023
wpDiscuz <= 7.6.11 - Cross-Site Request Forgery Patched CVE-2023-47775 4.3 Vladislav Pokrovsky (ΞX.MI) November 14, 2023
wpDiscuz <= 7.6.11 - Unauthenticated Stored Cross-Site Scripting via Comment Uploaded Image Filename Patched CVE-2023-47185 7.2 Vladislav Pokrovsky (ΞX.MI) October 31, 2023
wpDiscuz <= 7.6.10 - Unauthenticated Content Injection Patched CVE-2023-46310 4.3 Revan Arifio October 22, 2023
wpDiscuz <= 7.6.3 - Authenticated(Author+) Insecure Direct Object Reference Patched CVE-2023-46311 2.7 Revan Arifio October 22, 2023
wpDiscuz <= 7.6.10 - Insufficient Authorization to Comment Submission on Deleted Posts Patched CVE-2023-46309 5.3 Revan Arifio October 20, 2023
wpDiscuz <= 7.6.3 - Missing Authorization via AJAX actions Patched CVE-2023-45760 5.4 Vladislav Pokrovsky (ΞX.MI) October 12, 2023
wpDiscuz <= 7.6.5 - Unauthenticated SQL Injection Patched 8.8 September 18, 2023
wpDiscuz <= 7.6.3 - Insecure Direct Object Reference to Post Rating Increase/Decrease Patched CVE-2023-3998 5.3 Vladislav Pokrovsky (ΞX.MI) September 12, 2023
wpDiscuz <= 7.6.3 - Insecure Direct Object Reference to Comment Rating Increase/Decrease Patched CVE-2023-3869 5.3 Vladislav Pokrovsky (ΞX.MI) September 12, 2023
Comments – wpDiscuz <= 7.4.2 - Insecure Direct Object References Patched CVE-2022-43492 5.4 Dhakal Ananda October 28, 2022
Comments - wpDiscuz <= 7.3.11 Sensitive Information Disclosure Patched CVE-2022-23984 3.7 Muhammad Daffa February 10, 2022
Comments - wpDiscuz <= 7.3.3 - Arbitrary Comment Addition/Edition/Deletion by Cross-Site Request Forgery Patched CVE-2021-24806 4.3 Brandon James Roldan (tomorrowisnew) October 11, 2021
Comments - wpDiscuz <= 7.3.0 - Authenticated Stored Cross-Site Scripting Patched CVE-2021-24737 4.8 Phu Tran September 13, 2021
Comments - wpDiscuz 7.0 - 7.0.4 - Unauthenticated Arbitrary File Upload leading to Remote Code Execution Patched CVE-2020-24186 9.8 Chloe Chamberland June 6, 2021
Comments - wpDiscuz <= 5.3.5 - Blind SQL Injection via order Parameter Patched CVE-2020-13640 9.8 asterite June 12, 2020
Comments - wpDiscuz <= 3.1.4 - Reflected Cross-Site Scripting Patched 6.1 Kacper Szurek May 30, 2016

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation