Disqus Comment System
disqus-comment-system · plugin
Known security vulnerabilities for Disqus Comment System. Find out in seconds which version runs on your site with WP Lens.
2 known vulnerabilities
2 with public exploit code · latest Aug 19, 2014
Listed on wordpress.org · latest 3.1.5 · last updated Sep 23, 2026 · 30K+ installs
wordpress.org status checked on Oct 5, 2026
Vulnerabilities
- Medium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the Disqus Comment System plugin before 2.76 for WordPress allow remote attack
- Medium 4.3
Cross-site scripting (XSS) vulnerability in upgrade.php in the Disqus Comment System plugin before 2.76 for WordPress allows remote attacker
The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).