Comments – wpDiscuz

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   Comments – wpDiscuz

Information

Software Type Plugin
Software Slug wpdiscuz (view on wordpress.org)
Software Status Active
Software Author advancedcoding
Software Website wpdiscuz.com
Software Downloads 3,318,832
Software Active Installs 80,000
Software Record Last Updated May 20, 2024

18 Vulnerabilities

Comments - wpDiscuz 7.0 - 7.0.4 - Unauthenticated Arbitrary File Upload leading to Remote Code Execution
9.8
CVE-2020-24186
Jun 6, 2021
Researcher: Chloe Chamberland
Comments - wpDiscuz <= 5.3.5 - Blind SQL Injection via order Parameter
9.8
CVE-2020-13640
Jun 12, 2020
Researcher: asterite
wpDiscuz <= 7.6.5 - Unauthenticated SQL Injection
8.8
CVE ID Unknown
Sep 18, 2023
Researchers:
wpDiscuz <= 7.6.11 - Unauthenticated Stored Cross-Site Scripting via Comment Uploaded Image Filename
7.2
CVE-2023-47185
Oct 31, 2023
Researcher: Vladislav Pokrovsky (ΞX.MI)
wpDiscuz <= 7.6.15 - Authenticated (Author+) Stored Cross-Site Scripting via Uploaded Image Alternative Text
6.4
CVE-2024-2477
Apr 22, 2024
Researcher: Ngô Thiên An (ancorn_)
Comments - wpDiscuz <= 3.1.4 - Reflected Cross-Site Scripting
6.1
CVE ID Unknown
May 30, 2016
Researcher: Kacper Szurek
wpDiscuz <= 7.6.3 - Missing Authorization via AJAX actions
5.4
CVE-2023-45760
Oct 12, 2023
Researcher: Vladislav Pokrovsky (ΞX.MI)
Comments – wpDiscuz <= 7.4.2 - Insecure Direct Object References
5.4
CVE-2022-43492
Oct 28, 2022
Researcher: Dhakal Ananda
wpDiscuz <= 7.6.10 - Insufficient Authorization to Comment Submission on Deleted Posts
5.3
CVE-2023-46309
Oct 20, 2023
Researcher: Revan Arifio
wpDiscuz <= 7.6.3 - Insecure Direct Object Reference to Comment Rating Increase/Decrease
5.3
CVE-2023-3869
Sep 12, 2023
Researcher: Vladislav Pokrovsky (ΞX.MI)
wpDiscuz <= 7.6.3 - Insecure Direct Object Reference to Post Rating Increase/Decrease
5.3
CVE-2023-3998
Sep 12, 2023
Researcher: Vladislav Pokrovsky (ΞX.MI)
Comments - wpDiscuz <= 7.3.0 - Authenticated Stored Cross-Site Scripting
4.8
CVE-2021-24737
Sep 13, 2021
Researcher: Phu Tran
wpDiscuz <= 7.6.12 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2023-51691
Nov 17, 2023
Researcher: Jeongwoo-Lee(Roronoa)
wpDiscuz <= 7.6.11 - Cross-Site Request Forgery
4.3
CVE-2023-47775
Nov 14, 2023
Researcher: Vladislav Pokrovsky (ΞX.MI)
wpDiscuz <= 7.6.10 - Unauthenticated Content Injection
4.3
CVE-2023-46310
Oct 22, 2023
Researcher: Revan Arifio
Comments - wpDiscuz <= 7.3.3 - Arbitrary Comment Addition/Edition/Deletion by Cross-Site Request Forgery
4.3
CVE-2021-24806
Oct 11, 2021
Researcher: Brandon James Roldan (tomorrowisnew)
Comments - wpDiscuz <= 7.3.11 Sensitive Information Disclosure
3.7
CVE-2022-23984
Feb 10, 2022
Researcher: Muhammad Daffa
wpDiscuz <= 7.6.3 - Authenticated(Author+) Insecure Direct Object Reference
2.7
CVE-2023-46311
Oct 22, 2023
Researcher: Revan Arifio
Title Status CVE ID CVSS Researchers Date
Comments - wpDiscuz 7.0 - 7.0.4 - Unauthenticated Arbitrary File Upload leading to Remote Code Execution Patched CVE-2020-24186 9.8 Chloe Chamberland June 6, 2021
Comments - wpDiscuz <= 5.3.5 - Blind SQL Injection via order Parameter Patched CVE-2020-13640 9.8 asterite June 12, 2020
wpDiscuz <= 7.6.5 - Unauthenticated SQL Injection Patched 8.8 September 18, 2023
wpDiscuz <= 7.6.11 - Unauthenticated Stored Cross-Site Scripting via Comment Uploaded Image Filename Patched CVE-2023-47185 7.2 Vladislav Pokrovsky (ΞX.MI) October 31, 2023
wpDiscuz <= 7.6.15 - Authenticated (Author+) Stored Cross-Site Scripting via Uploaded Image Alternative Text Patched CVE-2024-2477 6.4 Ngô Thiên An (ancorn_) April 22, 2024
Comments - wpDiscuz <= 3.1.4 - Reflected Cross-Site Scripting Patched 6.1 Kacper Szurek May 30, 2016
wpDiscuz <= 7.6.3 - Missing Authorization via AJAX actions Patched CVE-2023-45760 5.4 Vladislav Pokrovsky (ΞX.MI) October 12, 2023
Comments – wpDiscuz <= 7.4.2 - Insecure Direct Object References Patched CVE-2022-43492 5.4 Dhakal Ananda October 28, 2022
wpDiscuz <= 7.6.10 - Insufficient Authorization to Comment Submission on Deleted Posts Patched CVE-2023-46309 5.3 Revan Arifio October 20, 2023
wpDiscuz <= 7.6.3 - Insecure Direct Object Reference to Comment Rating Increase/Decrease Patched CVE-2023-3869 5.3 Vladislav Pokrovsky (ΞX.MI) September 12, 2023
wpDiscuz <= 7.6.3 - Insecure Direct Object Reference to Post Rating Increase/Decrease Patched CVE-2023-3998 5.3 Vladislav Pokrovsky (ΞX.MI) September 12, 2023
Comments - wpDiscuz <= 7.3.0 - Authenticated Stored Cross-Site Scripting Patched CVE-2021-24737 4.8 Phu Tran September 13, 2021
wpDiscuz <= 7.6.12 - Authenticated (Administrator+) Stored Cross-Site Scripting Patched CVE-2023-51691 4.4 Jeongwoo-Lee(Roronoa) November 17, 2023
wpDiscuz <= 7.6.11 - Cross-Site Request Forgery Patched CVE-2023-47775 4.3 Vladislav Pokrovsky (ΞX.MI) November 14, 2023
wpDiscuz <= 7.6.10 - Unauthenticated Content Injection Patched CVE-2023-46310 4.3 Revan Arifio October 22, 2023
Comments - wpDiscuz <= 7.3.3 - Arbitrary Comment Addition/Edition/Deletion by Cross-Site Request Forgery Patched CVE-2021-24806 4.3 Brandon James Roldan (tomorrowisnew) October 11, 2021
Comments - wpDiscuz <= 7.3.11 Sensitive Information Disclosure Patched CVE-2022-23984 3.7 Muhammad Daffa February 10, 2022
wpDiscuz <= 7.6.3 - Authenticated(Author+) Insecure Direct Object Reference Patched CVE-2023-46311 2.7 Revan Arifio October 22, 2023

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation