Skip to content
PluginCanary

Comments - wpDiscuz

by AdvancedCoding · 60,000+ active installs · Checked 3 Nov 2026
Healthy1 Warning

Healthy: vulnerability published 2 Sep 2026, fixed in 7.6.66.

83/ 100 Canary Score
Sub-scores for Comments - wpDiscuz
Ownership100
Maintenance100
Security60
Support80
Reputation70

How the score works

Active signals

Facts we detected, with links to the source.

  • WarningSEC-1Vulnerability published 2 Sep 2026, fixed in 7.6.66. Update to version 7.6.66 or later.2 Sep 2026Evidence
  • InfoSEC-36 vulnerabilities published in the last 24 months. Review this plugin.4 Nov 2026Evidence

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
AdvancedCoding30 Nov 2014 to 4 Nov 2026, 421 commits
taron9629 Jul 2020 to 20 Jul 2021, 20 commits

2 committers recorded. No ownership changes recorded since 3 Nov 2026.

Maintenance

Last release
6 days ago
Releases, 24 months
47
Tested up to
7.1 current
Requires PHP
7.4 supported 8.2+
Releases per quarter for Comments - wpDiscuz
Q1 20243
Q2 20244
Q3 20244
Q4 20243
Q1 20252
Q2 20254
Q3 20251
Q4 20258
Q1 20267
Q2 20269
Q3 202613
Q4 20263

Last release 29 Oct 2026. Tested with WordPress 7.1 (current).

Support

80% of 5 support threads resolved in the last 2 months.

Security record

PublishedIssueCVSSAffectedFixed inDays to patch
2 Sep 2026Comments – wpDiscuz < 7.6.66 - Unauthenticated SQL Injection7.5< 7.6.667.6.660
2 Jul 2026Comments <= 7.6.56 - Unauthenticated Stored Cross-Site Scripting via 'Website' Field7.2<= 7.6.567.6.570
12 Mar 2026Comments – wpDiscuz <= 7.6.46 - Authenticated (Admin+) Stored Cross-Site Scripting4.4<= 7.6.467.6.470
25 Dec 2025wpDiscuz <= 7.6.42 - Unauthenticated Insecure Direct Object Reference5.3<= 7.6.427.6.4422
11 Dec 2025Comments – wpDiscuz <= 7.6.39 - Unauthenticated Authentication Bypass Through Account Takeover8.1<= 7.6.397.6.400
22 Sep 2025wpDiscuz <= 7.6.33 - Missing Authorization4.3<= 7.6.337.6.340
24 Oct 2024Comments – wpDiscuz <= 7.6.24 - Authentication Bypass via WordPress.com OAuth provider9.8<= 7.6.247.6.250
1 Aug 2024Comments – wpDiscuz <= 7.6.21 - Unauthenticated HTML Injection5.3<= 7.6.217.6.220
6 Jun 2024Comments – wpDiscuz <= 7.6.18 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 7.6.187.6.190
22 Apr 2024wpDiscuz <= 7.6.15 - Authenticated (Author+) Stored Cross-Site Scripting via Uploaded Image Alternative Text6.4<= 7.6.157.6.160
17 Nov 2023wpDiscuz <= 7.6.12 - Authenticated (Administrator+) Stored Cross-Site Scripting4.4<= 7.6.127.6.130
14 Nov 2023wpDiscuz <= 7.6.11 - Cross-Site Request Forgery4.3<= 7.6.117.6.120
31 Oct 2023wpDiscuz <= 7.6.11 - Unauthenticated Stored Cross-Site Scripting via Comment Uploaded Image Filename7.2<= 7.6.117.6.121
22 Oct 2023wpDiscuz <= 7.6.3 - Authenticated(Author+) Insecure Direct Object Reference2.7<= 7.6.37.6.40
22 Oct 2023wpDiscuz <= 7.6.10 - Unauthenticated Content Injection4.3<= 7.6.107.6.110
20 Oct 2023wpDiscuz <= 7.6.10 - Insufficient Authorization to Comment Submission on Deleted Posts5.3<= 7.6.107.6.110
12 Oct 2023wpDiscuz <= 7.6.3 - Missing Authorization via AJAX actions5.4<= 7.6.37.6.40
18 Sep 2023wpDiscuz <= 7.6.5 - Unauthenticated SQL Injection8.8< 7.6.67.6.60
12 Sep 2023wpDiscuz <= 7.6.3 - Insecure Direct Object Reference to Post Rating Increase/Decrease5.3<= 7.6.37.6.41
12 Sep 2023wpDiscuz <= 7.6.3 - Insecure Direct Object Reference to Comment Rating Increase/Decrease5.3<= 7.6.37.6.41
28 Oct 2022Comments – wpDiscuz <= 7.4.2 - Insecure Direct Object References5.4<= 7.4.27.50
10 Feb 2022Comments - wpDiscuz <= 7.3.11 Sensitive Information Disclosure3.7<= 7.3.117.3.120
11 Oct 2021Comments - wpDiscuz <= 7.3.3 - Arbitrary Comment Addition/Edition/Deletion by Cross-Site Request Forgery4.3< 7.3.47.3.40
13 Sep 2021Comments - wpDiscuz <= 7.3.0 - Authenticated Stored Cross-Site Scripting4.8<= 7.3.07.3.26
6 Jun 2021Comments - wpDiscuz 7.0 - 7.0.4 - Unauthenticated Arbitrary File Upload leading to Remote Code Execution9.87.0 to 7.0.47.0.50

Source: Wordfence Intelligence.

Reputation

Average rating per quarter for Comments - wpDiscuz
Q1 20243.5
Q2 20245.0
Q3 20245.0
Q4 20245.0
Q1 20255.0
Q2 20254.5
Q3 20254.5
Q4 20254.5
Q1 20263.5
Q3 20263.0
Q4 20265.0

Average rating rose from 3.5 to 5.0 between Q1 2024 and Q4 2026.

Rating distribution
5 star514
4 star20
3 star16
2 star10
1 star21
Latest low reviews

Momentum

60,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for Comments - wpDiscuz
4 May 20261,647
11 May 20262,770
18 May 20263,883
25 May 202640,593
1 Jun 20265,536
8 Jun 202642,129
15 Jun 20265,590
22 Jun 20263,802
29 Jun 202621,257
6 Jul 202610,096
13 Jul 20264,196
20 Jul 20269,671
27 Jul 202648,078
3 Aug 202625,306
10 Aug 202624,809
17 Aug 20269,492
24 Aug 202658,044
31 Aug 202626,717
7 Sep 202641,703
14 Sep 202626,545
21 Sep 20266,199
28 Sep 20263,861
5 Oct 202622,227
12 Oct 20265,661
19 Oct 202612,026
26 Oct 202636,669
2 Nov 20261,712

Weekly downloads over the last 4 weeks are 24% below the 27-week average.

Healthier alternatives

Same category, higher Canary Score. Never sponsored.

Disable CommentsScore 93 · 100,000+Disable CommentsScore 91 · 1,000,000+Disqus Comment SystemScore 91 · 30,000+Comment Link Remove and Other Comment ToolsScore 91 · 8,000+Simply Disable CommentsScore 91 · 8,000+

Facts

Version7.6.74
AuthorAdvancedCoding
Added30 Nov 2014
Last updated29 Oct 2026
Active installs60,000+
Requires WordPress6.0
Tested up to7.1.4
Requires PHP7.4
CategoryCommunication & Messaging > Transactional Email
Tagscomment form, ajax comments, live comments, comment system, inline comments

Questions

Is Comments - wpDiscuz still maintained?

Comments - wpDiscuz was last updated on 29 Oct 2026. Its Canary status is Healthy.

Is Comments - wpDiscuz safe?

Comments - wpDiscuz has no open unpatched vulnerabilities on record. 6 vulnerabilities were published in the last 24 months. Its Canary status is Healthy.

Who owns Comments - wpDiscuz?

The wordpress.org author is AdvancedCoding. Recent committers: AdvancedCoding, taron96, gzakar, plugin-master. We have recorded no ownership change.

What can I use instead of Comments - wpDiscuz?

Plugins in the same category with a higher Canary Score: Disable Comments, Disable Comments, Disqus Comment System, Comment Link Remove and Other Comment Tools, Simply Disable Comments.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews, Wordfence Intelligence.Plugin data refreshed 3 Nov 2026.Report a data issue