AnyComment
Avoid: AnyComment is closed on wordpress.org and no longer gets updates.
Capped at 10 because the plugin is closed.
| Ownership | 100 |
|---|---|
| Maintenance | 10 |
| Security | 20 |
| Support | 70 |
| Reputation | 70 |
Active signals
Facts we detected, with links to the source.
- CriticalSEC-2Vulnerability published 13 Oct 2026 still has no fix after 14 days. Disable or replace the plugin. No fix has been released.27 Oct 2026Evidence
- CriticalSEC-1Vulnerability published 13 Oct 2026 with no patched version yet. Disable or replace the plugin until a fix is released.13 Oct 2026Evidence
- CriticalSEC-2Vulnerability published 31 Dec 2025 still has no fix after 14 days. Disable or replace the plugin. No fix has been released.14 Jan 2026Evidence
- CriticalSEC-1Vulnerability published 31 Dec 2025 with no patched version yet. Disable or replace the plugin until a fix is released.31 Dec 2025Evidence
- CriticalSEC-2Vulnerability published 8 Oct 2025 still has no fix after 14 days. Disable or replace the plugin. No fix has been released.22 Oct 2025Evidence
- CriticalSEC-1Vulnerability published 8 Oct 2025 with no patched version yet. Disable or replace the plugin until a fix is released.8 Oct 2025Evidence
- CriticalSEC-2Vulnerability published 12 Jul 2025 still has no fix after 14 days. Disable or replace the plugin. No fix has been released.26 Jul 2025Evidence
- CriticalSEC-1Vulnerability published 12 Jul 2025 with no patched version yet. Disable or replace the plugin until a fix is released.12 Jul 2025Evidence
- WarningCLS-1Closed on wordpress.org on 5 Oct 2026, reason: false. Replace this plugin. It no longer receives updates from wordpress.org.5 Oct 2026Evidence
- InfoSEC-34 vulnerabilities published in the last 24 months. Review this plugin.4 Nov 2026Evidence
Ownership timeline
Who commits to the plugin's code on wordpress.org, over time.
Commit history is collected for plugins with 1,000+ installs or on a watchlist. No ownership changes recorded since 3 Nov 2026.
Maintenance
- Last release
- unknown
- Releases, 24 months
- 0
- Tested up to
- unknown vs 7.1
- Requires PHP
- not stated supported 8.2+
Release history builds as we see new versions.
Support
Support history appears after our first snapshots of the forum counts.
Security record
| Published | Issue | CVSS | Affected | Fixed in | Days to patch |
|---|---|---|---|---|---|
| 13 Oct 2026 | AnyComment <= 0.3.6 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter | 7.2 | <= 0.3.6 | No fix | n/a |
| 31 Dec 2025 | AnyComment <= 0.3.6 - Missing Authorization | 4.3 | <= 0.3.6 | No fix | n/a |
| 8 Oct 2025 | AnyComment <= 0.3.6 - Authenticated (Subscriber+) SQL Injection | 6.5 | <= 0.3.6 | No fix | n/a |
| 12 Jul 2025 | AnyComment <= 0.3.6 - Unauthenticated Local File Inclusion | 8.1 | <= 0.3.6 | No fix | n/a |
| 18 Jul 2023 | Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get | 6.1 | <= 0.0.98 | 0.0.99 | n/a |
| 19 Jan 2022 | AnyComment <= 0.2.17 - Race Condition | 5.3 | < 0.2.18 | 0.2.18 | n/a |
| 19 Jan 2022 | AnyComment <= 0.2.17 - Cross-Site Request Forgery | 8.8 | < 0.2.18 | 0.2.18 | n/a |
| 20 Dec 2021 | AnyComment <= 0.3.4 - Open Redirect via redirect parameter | 5.4 | < 0.3.5 | 0.3.5 | n/a |
| 17 Jul 2018 | AnyComment <= 0.0.32 - Cross-Site Scripting | 6.1 | <= 0.0.32 | 0.0.33 | n/a |
Source: Wordfence Intelligence.
Reputation
No ratings yet.
Momentum
unknown active installs. History builds with each weekly snapshot.
Momentum history builds with each snapshot.
Healthier alternatives
Same category, higher Canary Score. Never sponsored.
Facts
| Version | not stated |
|---|---|
| Author | not stated |
| Added | not stated |
| Last updated | not stated |
| Active installs | unknown |
| Requires WordPress | not stated |
| Tested up to | not stated |
| Requires PHP | not stated |
| Category | Communication & Messaging > Transactional Email |
| Tags | not stated |
Questions
Is AnyComment still maintained?
No. AnyComment was closed on wordpress.org on 5 Oct 2026 (false) and gets no updates there.
Is AnyComment safe?
AnyComment has 4 published vulnerabilities with no patched version. Its Canary status is Avoid.
Who owns AnyComment?
The wordpress.org author is not listed. We have recorded no ownership change.
What can I use instead of AnyComment?
Plugins in the same category with a higher Canary Score: Buttonizer - Floating Menus, Sticky Buttons, & Popup Builder, Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button - Chaty, Really Simple CAPTCHA, Social Chat - Click To Chat App Button, WebSub (FKA. PubSubHubbub).