Comments – wpDiscuz

Уязвимости

• CVE-2024-9488без авторизации≤ 7.6.24

  Comments – wpDiscuz <= 7.6.24 - Authentication Bypass via WordPress.com OAuth provider

  Критич. 9.8

• CVE-2020-13640без авторизации

  A SQL injection issue in the gVectors wpDiscuz plugin 5.3.5 and earlier for WordPress allows remote attackers to execute arbitrary SQL comma

  Критич. 9.8

• CVE-2026-22193без авторизации→ 7.6.47

  wpDiscuz before 7.6.47 - SQL Injection in getAllSubscriptions()

  Критич. 9.2

• CVE-2023-47775без авторизации · нужен клик≤ 7.6.11

  WordPress wpDiscuz Plugin <= 7.6.11 is vulnerable to Cross Site Request Forgery (CSRF)

  Высокий 8.8

• CVE-2023-45760нужен вход≤ 7.6.3

  WordPress wpDiscuz plugin <= 7.6.3 - Broken Access Control vulnerability

  Высокий 8.8

• CVE-2022-43492подписчик+

  WordPress Comments – wpDiscuz plugin 7.4.2 - Auth. Insecure Direct Object References (IDOR) vulnerability

  Высокий 8.8

• CVE-2026-22182без авторизации→ 7.6.47

  wpDiscuz before 7.6.47 - Unauthenticated Email Notification Flood via wpdCheckNotificationType

  Высокий 8.7

• CVE-2022-23984без авторизации≤ 7.3.11

  WordPress wpDiscuz plugin <= 7.3.11 - Sensitive Information Disclosure

  Высокий 7.5

• CVE-2023-46309без авторизации≤ 7.6.10

  WordPress wpDiscuz plugin <= 7.6.10 - Broken Access Control vulnerability

  Высокий 7.3

• CVE-2026-9148без авторизации≤ 7.6.56

  Comments <= 7.6.56 - Unauthenticated Stored Cross-Site Scripting via 'Website' Field

  Высокий 7.2

• CVE-2026-22216без авторизации→ 7.6.47

  wpDiscuz before 7.6.47 - No Rate Limiting on Subscription Endpoints with LIKE Wildcard Bypass

  Средний 6.9

• CVE-2026-22201без авторизации→ 7.6.47

  wpDiscuz before 7.6.47 - IP Address Spoofing in getIP()

  Средний 6.9

• CVE-2026-22203высокие права→ 7.6.47

  wpDiscuz before 7.6.47 - Options Export Leaks OAuth Secrets in Plaintext

  Средний 6.9

• CVE-2023-46311высокие права≤ 7.6.3

  WordPress wpDiscuz Plugin <= 7.6.3 is vulnerable to Insecure Direct Object References (IDOR)

  Средний 6.5

• CVE-2026-22204без авторизации→ 7.6.47

  wpDiscuz before 7.6.47 - Unsanitized Cookie Email Used as wp_mail() Recipient

  Средний 6.3

• CVE-2026-22202без авторизации · нужен клик→ 7.6.47

  wpDiscuz before 7.6.47 - Destructive GET Action Deletes All Comments by Email

  Средний 6.1

• CVE-2024-6704без авторизации≤ 7.6.21

  Comments – wpDiscuz <= 7.6.21 - Unauthenticated HTML Injection

  Средний 6.1

• CVE-2023-46310без авторизации≤ 7.6.10

  WordPress wpDiscuz plugin <= 7.6.10 - Content Injection vulnerability

  Средний 6.1

• CVE-2023-47185без авторизации · нужен клик≤ 7.6.11

  WordPress wpDiscuz Plugin <= 7.6.11 is vulnerable to Cross Site Scripting (XSS)

  Средний 6.1

• CVE-2024-35681нужен вход≤ 7.6.18

  WordPress wpDiscuz plugin <= 7.6.18 - Cross Site Scripting (XSS) vulnerability

  Средний 5.4

• CVE-2024-2477автор+≤ 7.6.15

  wpDiscuz <= 7.6.15 - Authenticated (Author+) Stored Cross-Site Scripting via Uploaded Image Alternative Text

  Средний 5.4

• CVE-2026-22215без авторизации · нужен клик→ 7.6.47

  wpDiscuz before 7.6.47 - Missing CSRF Protection on wpdGetFollowsPage

  Средний 5.3

• CVE-2025-68997без авторизации≤ 7.6.43

  WordPress wpDiscuz plugin <= 7.6.43 - Insecure Direct Object References (IDOR) vulnerability

  Средний 5.3

• CVE-2023-3998без авторизации≤ 7.6.3

  wpDiscuz <= 7.6.3 - Insecure Direct Object Reference to Post Rating Increase/Decrease

  Средний 5.3

• CVE-2023-3869без авторизации≤ 7.6.3

  wpDiscuz <= 7.6.3 - Insecure Direct Object Reference to Comment Rating Increase/Decrease

  Средний 5.3

• CVE-2026-22183нужен вход→ 7.6.47

  wpDiscuz before 7.6.47 - Stored Cross-Site Scripting in Inline Comment Preview

  Средний 5.3

• CVE-2026-22209админ→ 7.6.47

  wpDiscuz before 7.6.47 - Cross-Site Scripting via Unescaped Custom CSS in Style Tag

  Средний 5.1

• CVE-2023-51691высокие права≤ 7.6.12

  WordPress wpDiscuz Plugin <= 7.6.12 is vulnerable to Cross Site Scripting (XSS)

  Средний 4.8

• CVE-2025-59591нужен вход≤ 7.6.33

  WordPress wpDiscuz Plugin <= 7.6.33 - Broken Access Control Vulnerability

  Средний 4.3

• CVE-2026-22210нужен вход→ 7.6.47

  wpDiscuz before 7.6.47 - Cross-Site Scripting via Unescaped Attachment URLs

  Низкий 2.1