Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-09-03
Comments - SQL Injection (CVE-2026-19704)
The Comments WordPress plugin before 7.6.66 does not validate a value used to build a database query, allowing unauthenticated users to inject SQL and read comments they are not entitled to see, including comments awaiting moderation, comments marked as spam or trashed, and comments on private and draft posts. The injected text reaches the query as grammar rather than as data and does not yield extraction of arbitrary data, so the confidentiality impact is the disclosed comment content rather than the database at large.
PLUGIN
Comments
CVE-2026-19704
Risk Score
Threat Entry
Updated 2026-08-26
Comments - Cross-Site Scripting (XSS) (CVE-2026-15032)
The Comments WordPress plugin before 7.6.60 does not properly escape a user-supplied URL before outputting it inside an HTML attribute, allowing unauthenticated users to store a Cross-Site Scripting payload that executes in the browser of any user, including administrators, who views the affected content.
PLUGIN
Comments
CVE-2026-15032
Risk Score
Threat Entry
Updated 2026-06-17
Comments - Security Vulnerability (CVE-2025-13820)
The Comments WordPress plugin before 7.6.40 does not properly validate user's identity when using the disqus.com provider, allowing an attacker to log in to any user (when knowing their email address) when such user does not have an account on disqus.com yet.
PLUGIN
Comments
CVE-2025-13820
Risk Score
Threat Entry
Updated 2026-06-17
Comments - Security Vulnerability (CVE-2025-2809)
The azurecurve Shortcodes in Comments plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.0.2. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
PLUGIN
Comments
CVE-2025-2809
Risk Score