Unknown Comments vulnerabilities

3 CVEs affecting Unknown Comments, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-19704, published 2026-09-02.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-15032, published 2026-08-07. Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days. The Comments WordPress plugin before 7.6.60 does not properly escape a user-supplied URL before outputting it inside an HTML attribute, allowing unauthenticated users to store a Cross-Site Scripting…
CVE-2025-13820, published 2026-01-01. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. The Comments WordPress plugin before 7.6.40 does not properly validate user's identity when using the disqus.com provider, allowing an attacker to log in to any user (when knowing their email…
CVE-2026-19704, published 2026-09-02. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. The Comments WordPress plugin before 7.6.66 does not validate a value used to build a database query, allowing unauthenticated users to inject SQL and read comments they are not entitled to see,…