Comments (Unknown) - vulnerabilities (CVEs)

7 CVEs, 0 in the last 30 days, 2 known versions, newest CVE from 2026-09-02. Vendor: Unknown.

CVEs of Comments

• CVE-2026-19704 - CVSS 5.3 (medium), 2026-09-02: The Comments WordPress plugin before 7.6.66 does not validate a value used to build a database query, allowing unauthenticated users to inject SQL and read…
• CVE-2026-15032 - CVSS 6.1 (medium), 2026-08-07: The Comments WordPress plugin before 7.6.60 does not properly escape a user-supplied URL before outputting it inside an HTML attribute, allowing…
• CVE-2025-13820 - CVSS 5.3 (medium), 2026-01-01: The Comments WordPress plugin before 7.6.40 does not properly validate user's identity when using the disqus.com provider, allowing an attacker to log in to…
• CVE-2023-2489 - CVSS 4.8 (medium), 2023-06-05: The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2023 does not sanitise and escape some of its settings, which could…
• CVE-2023-2488 - CVSS 6.1 (medium), 2023-06-05: The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2023 does not sanitise and escape various parameters before outputting…
• CVE-2022-4120 - CVSS 9.8 (critical), 2022-12-26: The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2022.6 passes base64 encoded user input to the unserialize() PHP…
• CVE-2021-24517 - CVSS 5.4 (medium), 2021-09-06: The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2021.18 does not escape some of its settings, allowing high privilege…