Comments – wpDiscuz

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   Comments – wpDiscuz

Information

Software Type Plugin
Software Slug wpdiscuz (view on wordpress.org)
Software Status Active
Software Author advancedcoding
Software Website wpdiscuz.com
Software Downloads 3,306,697
Software Active Installs 80,000
Software Record Last Updated May 10, 2024

18 Vulnerabilities

wpDiscuz <= 7.6.15 - Authenticated (Author+) Stored Cross-Site Scripting via Uploaded Image Alternative Text
6.4
CVE-2024-2477
Apr 22, 2024
Researcher: Ngô Thiên An (ancorn_)
wpDiscuz <= 7.6.12 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2023-51691
Nov 17, 2023
Researcher: Jeongwoo-Lee(Roronoa)
wpDiscuz <= 7.6.11 - Cross-Site Request Forgery
4.3
CVE-2023-47775
Nov 14, 2023
Researcher: Vladislav Pokrovsky (ΞX.MI)
wpDiscuz <= 7.6.11 - Unauthenticated Stored Cross-Site Scripting via Comment Uploaded Image Filename
7.2
CVE-2023-47185
Oct 31, 2023
Researcher: Vladislav Pokrovsky (ΞX.MI)
wpDiscuz <= 7.6.10 - Unauthenticated Content Injection
4.3
CVE-2023-46310
Oct 22, 2023
Researcher: Revan Arifio
wpDiscuz <= 7.6.3 - Authenticated(Author+) Insecure Direct Object Reference
2.7
CVE-2023-46311
Oct 22, 2023
Researcher: Revan Arifio
wpDiscuz <= 7.6.10 - Insufficient Authorization to Comment Submission on Deleted Posts
5.3
CVE-2023-46309
Oct 20, 2023
Researcher: Revan Arifio
wpDiscuz <= 7.6.3 - Missing Authorization via AJAX actions
5.4
CVE-2023-45760
Oct 12, 2023
Researcher: Vladislav Pokrovsky (ΞX.MI)
wpDiscuz <= 7.6.5 - Unauthenticated SQL Injection
8.8
CVE ID Unknown
Sep 18, 2023
Researchers:
wpDiscuz <= 7.6.3 - Insecure Direct Object Reference to Post Rating Increase/Decrease
5.3
CVE-2023-3998
Sep 12, 2023
Researcher: Vladislav Pokrovsky (ΞX.MI)
wpDiscuz <= 7.6.3 - Insecure Direct Object Reference to Comment Rating Increase/Decrease
5.3
CVE-2023-3869
Sep 12, 2023
Researcher: Vladislav Pokrovsky (ΞX.MI)
Comments – wpDiscuz <= 7.4.2 - Insecure Direct Object References
5.4
CVE-2022-43492
Oct 28, 2022
Researcher: Dhakal Ananda
Comments - wpDiscuz <= 7.3.11 Sensitive Information Disclosure
3.7
CVE-2022-23984
Feb 10, 2022
Researcher: Muhammad Daffa
Comments - wpDiscuz <= 7.3.3 - Arbitrary Comment Addition/Edition/Deletion by Cross-Site Request Forgery
4.3
CVE-2021-24806
Oct 11, 2021
Researcher: Brandon James Roldan (tomorrowisnew)
Comments - wpDiscuz <= 7.3.0 - Authenticated Stored Cross-Site Scripting
4.8
CVE-2021-24737
Sep 13, 2021
Researcher: Phu Tran
Comments - wpDiscuz 7.0 - 7.0.4 - Unauthenticated Arbitrary File Upload leading to Remote Code Execution
9.8
CVE-2020-24186
Jun 6, 2021
Researcher: Chloe Chamberland
Comments - wpDiscuz <= 5.3.5 - Blind SQL Injection via order Parameter
9.8
CVE-2020-13640
Jun 12, 2020
Researcher: asterite
Comments - wpDiscuz <= 3.1.4 - Reflected Cross-Site Scripting
6.1
CVE ID Unknown
May 30, 2016
Researcher: Kacper Szurek
Title CVE ID CVSS Researchers Date
wpDiscuz <= 7.6.15 - Authenticated (Author+) Stored Cross-Site Scripting via Uploaded Image Alternative Text CVE-2024-2477 6.4 Ngô Thiên An (ancorn_) April 22, 2024
wpDiscuz <= 7.6.12 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2023-51691 4.4 Jeongwoo-Lee(Roronoa) November 17, 2023
wpDiscuz <= 7.6.11 - Cross-Site Request Forgery CVE-2023-47775 4.3 Vladislav Pokrovsky (ΞX.MI) November 14, 2023
wpDiscuz <= 7.6.11 - Unauthenticated Stored Cross-Site Scripting via Comment Uploaded Image Filename CVE-2023-47185 7.2 Vladislav Pokrovsky (ΞX.MI) October 31, 2023
wpDiscuz <= 7.6.10 - Unauthenticated Content Injection CVE-2023-46310 4.3 Revan Arifio October 22, 2023
wpDiscuz <= 7.6.3 - Authenticated(Author+) Insecure Direct Object Reference CVE-2023-46311 2.7 Revan Arifio October 22, 2023
wpDiscuz <= 7.6.10 - Insufficient Authorization to Comment Submission on Deleted Posts CVE-2023-46309 5.3 Revan Arifio October 20, 2023
wpDiscuz <= 7.6.3 - Missing Authorization via AJAX actions CVE-2023-45760 5.4 Vladislav Pokrovsky (ΞX.MI) October 12, 2023
wpDiscuz <= 7.6.5 - Unauthenticated SQL Injection 8.8 September 18, 2023
wpDiscuz <= 7.6.3 - Insecure Direct Object Reference to Post Rating Increase/Decrease CVE-2023-3998 5.3 Vladislav Pokrovsky (ΞX.MI) September 12, 2023
wpDiscuz <= 7.6.3 - Insecure Direct Object Reference to Comment Rating Increase/Decrease CVE-2023-3869 5.3 Vladislav Pokrovsky (ΞX.MI) September 12, 2023
Comments – wpDiscuz <= 7.4.2 - Insecure Direct Object References CVE-2022-43492 5.4 Dhakal Ananda October 28, 2022
Comments - wpDiscuz <= 7.3.11 Sensitive Information Disclosure CVE-2022-23984 3.7 Muhammad Daffa February 10, 2022
Comments - wpDiscuz <= 7.3.3 - Arbitrary Comment Addition/Edition/Deletion by Cross-Site Request Forgery CVE-2021-24806 4.3 Brandon James Roldan (tomorrowisnew) October 11, 2021
Comments - wpDiscuz <= 7.3.0 - Authenticated Stored Cross-Site Scripting CVE-2021-24737 4.8 Phu Tran September 13, 2021
Comments - wpDiscuz 7.0 - 7.0.4 - Unauthenticated Arbitrary File Upload leading to Remote Code Execution CVE-2020-24186 9.8 Chloe Chamberland June 6, 2021
Comments - wpDiscuz <= 5.3.5 - Blind SQL Injection via order Parameter CVE-2020-13640 9.8 asterite June 12, 2020
Comments - wpDiscuz <= 3.1.4 - Reflected Cross-Site Scripting 6.1 Kacper Szurek May 30, 2016

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation