Comments – wpDiscuz

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory searches this plugin turns up in, and which way each one is moving. WordPress.org publishes no history of search positions, so this starts the day we first tracked a keyword and never backfills.

wp.org is where the directory puts the plugin for that search. On merit is where it would sit if results were ranked on rating, support and updates, without the install boost. The last column is how far the wp.org position moved, from our first reading in the last 90 days to the latest.

300 searches this plugin appeared in over the last 90 days, 20 listed. 248 left out as unrelated or noise (years, numbers, stray words).

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 89% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Crossed into this band 2 months ago and a band this size takes about a year or more to cross, so the real count is still just under 70K.

1. ★★★★★ bellakaroo

   10mo ago

   Day 2 I managed after a day and half to get rid of the “fill in the required fields” message that popup for users wherether logged in or not, its the rich editor and the name and email field that causes this issue. If I make the name field required and the email optional and deactivate the rich editor on both desktip and mobile then the message dissappear but now it creates 2 new issue. Star ratings are not clickable and comment nesting for replies doesn’t work eventhough the feature is turned on in wp discussion tab. If you reply to a comment the comment gets posted as an individual /standalone comment at the top of the comment section and not as a nested reply. Honestly, I’m done struggling. I fix 1 thing and multiple other stuff breaks in your plugin! I’m now dropping star ratings because of the additional issues that now arised. —— Day 1 The plugin is nice, especially the star ratings but it’s a nightmare to setup. The whole day I’ve tried to get the plugin not to show “input too short” and “fill in the required fields” error messages. My input is set to min 1 and unlimited to max so basically the default settings but it gives the error of “input too short” so I changed it from 1 to 2 min and from unlimited to 1000 max and finally the message stopped. But now it gives the “fill in the required fields” error. I unticked the option in the wp discussion tab for users must fill in their name and email before they can comment. Great. Now I disabled the required field in the wpdiscuz default form field for name and email. It worked once. I closed out of my site, opened it again and navigated to a post and tried to comment and theres the “fill in the required fields” block, so I fill in the name eventhough it’s not required anymore and the email and hit the button and there’s the message again. There’s nothing left to fill in. I changed the comment requirements to users must be logged in, now the name and email boxes vanish but I still can’t comment, the same error message popup. I even went as far to disable everything in the wordpress discussion tab, cleared the cache and cookies, logged in via incognito and my tablet on another email and still get the same error message. I deactivated all my plugins and still same message. I don’t use jetpack so it can’t be their comment form thing causing conflicts. I switched from my kadence theme to the default twenty-five theme and same error. It works once. There’s no restrictions setup to how many times someone can comment either. Guests that comment needs to fill out the name and email box everytime they want to reply to a thread, aint filling it in once enough until they leave the page? Only thing I want is for logged out users not to be able to comment under the anonymous lable. I’m about to uninstall the plugin as I can’t be bothered to struggle this much with it. It’s definitely not worth spending another day trying to get rid of those messages. I’m not a developer, and before I spend money on hiring one just to make a plugin work, I’d rather just not use it. This topic was modified 6 months ago by bellakaroo.

   Read on wp.org ↗
2. ★★★★★ mbellinger

   10mo ago

   Downloaded the Plugin today.Installation, Setup easy, is up & running in a few minutes, perhaps not perfect within these few minutes, but working.Goog overview, goog presentation of settings.Best of all – it is free of charge obviously 🙂 – Thank you Developers !Collecting experience now…

   Read on wp.org ↗
3. ★★★★★ Olaf Lederer

   11mo ago

   After an upgrade to php 8.3 the plugin broke my customer’s website. It took some discussions here at WP.org to convince the plugin’s team to add more validations into their code.But after they fixed it the PHP errors are gone. Thanks!

   Read on wp.org ↗
4. ★★★★★ Grant

   12mo ago

   wpDiscuz is user-friendly, pretty light as a plugin, and has a ton of add-ons. The support staff are very efficient too. Give wpDiscuz a try.

   Read on wp.org ↗
5. ★★★★★ Willem Jurka

   1.1y ago

   I have been using wpDiscuz for a long time and I’m very satisfied with it. The plugin is reliable, user-friendly and offers everything I need for managing comments on my site.

   Read on wp.org ↗
6. ★★★★★ tierschutzmato

   1.2y ago

   Ein wirklich guter support. Und auch das Script finde ich super.

   Read on wp.org ↗
7. ★★★★★ c12gene

   1.2y ago

   They just pack too much junk into this app. I can’t even figure out how to delete comments…there is so much nonsense even the basic stuff is confusing

   Read on wp.org ↗
8. ★★★★★ ZoBabe

   1.2y ago

   Seem like you can do pretty much anything! And if you get stuck, the support forum is extremely responsive and helpful.

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 6.59 Fixed: An issue preventing the proper deletion of attachments. Fixed: An Undefined index warning triggered during the active theme file validation check. 6.59
2. — Version 6.58 Fixed: Missing escaping issues Fixed: Internal images were missing in the combined version of the CSS 6.58
3. — Version 6.57 Fixed: Low-severity security issues Fixed: Attachment delete AJAX dereferences a missing comment before validation Fixed: Bubble live-update AJAX renders arbitrary comment IDs without per-comment authorization Fixed: Pos 6.57
4. — Version 6.60 Fixed: Stored XSS vulnerability in the comment image URL conversion. Image URLs are now escaped for HTML attribute output. Thanks to hieus for responsibly reporting the issue. Fixed: Missing escaping on the custom URL fi 6.60
5. — Version 6.62 Improved: Additional HTML tag escaping when comment editor phrases are printed into inline JavaScript. Fixed: Imported phrase files were not sanitized on upload, unlike phrases saved from the Phrases settings page. Fixed 6.62
6. — Version 6.63 Fixed: An issue with comment editing( current_user_can(‘moderate_comments’) ) when comments are closed 6.63

All 27 disclosed vulnerabilities are patched in the current version (7.6.74). Sites still on an older version should update.

1. Patched High · 7.5 Comments – wpDiscuz < 7.6.66 - Unauthenticated SQL Injection ↗
   2026-09-02 CVE-2026-19704 Improper Neutralization of Special Elements used in an SQL Command Affects < 7.6.66 Patched in 7.6.66
2. Patched High · 7.2 Comments <= 7.6.56 - Unauthenticated Stored Cross-Site Scripting via 'Website' Field ↗
   2026-07-02 CVE-2026-9148 Improper Neutralization of Input During Web Page Generation Affects <= 7.6.56 Patched in 7.6.57
3. Patched Medium · 4.4 Comments – wpDiscuz <= 7.6.46 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
   2026-03-12 CVE-2026-22209 Improper Neutralization of Input During Web Page Generation Affects <= 7.6.46 Patched in 7.6.47
4. Patched Medium · 5.3 wpDiscuz <= 7.6.42 - Unauthenticated Insecure Direct Object Reference ↗
   2025-12-25 CVE-2025-68997 Authorization Bypass Through User-Controlled Key Affects <= 7.6.42 Patched in 7.6.44
5. Patched High · 8.1 Comments – wpDiscuz <= 7.6.39 - Unauthenticated Authentication Bypass Through Account Takeover ↗
   2025-12-11 CVE-2025-13820 Authorization Bypass Through User-Controlled Key Affects <= 7.6.39 Patched in 7.6.40
6. Patched Medium · 4.3 wpDiscuz <= 7.6.33 - Missing Authorization ↗
   2025-09-22 CVE-2025-59591 Missing Authorization Affects <= 7.6.33 Patched in 7.6.34
7. Patched Critical · 9.8 Comments – wpDiscuz <= 7.6.24 - Authentication Bypass via WordPress.com OAuth provider ↗
   2024-10-24 CVE-2024-9488 Authentication Bypass Using an Alternate Path or Channel Affects <= 7.6.24 Patched in 7.6.25
8. Patched Medium · 5.3 Comments – wpDiscuz <= 7.6.21 - Unauthenticated HTML Injection ↗
   2024-08-01 CVE-2024-6704 Improper Neutralization of Input During Web Page Generation Affects <= 7.6.21 Patched in 7.6.22
9. Patched Medium · 6.4 Comments – wpDiscuz <= 7.6.18 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
   2024-06-06 CVE-2024-35681 Improper Neutralization of Input During Web Page Generation Affects <= 7.6.18 Patched in 7.6.19
10. Patched Medium · 6.4 wpDiscuz <= 7.6.15 - Authenticated (Author+) Stored Cross-Site Scripting via Uploaded Image Alternative Text ↗
    2024-04-22 CVE-2024-2477 Improper Neutralization of Input During Web Page Generation Affects <= 7.6.15 Patched in 7.6.16
11. Patched Medium · 4.4 wpDiscuz <= 7.6.12 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗
    2023-11-17 CVE-2023-51691 Improper Neutralization of Input During Web Page Generation Affects <= 7.6.12 Patched in 7.6.13
12. Patched Medium · 4.3 wpDiscuz <= 7.6.11 - Cross-Site Request Forgery ↗
    2023-11-14 CVE-2023-47775 Cross-Site Request Forgery Affects <= 7.6.11 Patched in 7.6.12
13. Patched High · 7.2 wpDiscuz <= 7.6.11 - Unauthenticated Stored Cross-Site Scripting via Comment Uploaded Image Filename ↗
    2023-10-31 CVE-2023-47185 Improper Neutralization of Input During Web Page Generation Affects <= 7.6.11 Patched in 7.6.12
14. Patched Low · 2.7 wpDiscuz <= 7.6.3 - Authenticated(Author+) Insecure Direct Object Reference ↗
    2023-10-22 CVE-2023-46311 Authorization Bypass Through User-Controlled Key Affects <= 7.6.3 Patched in 7.6.4
15. Patched Medium · 4.3 wpDiscuz <= 7.6.10 - Unauthenticated Content Injection ↗
    2023-10-22 CVE-2023-46310 Improper Neutralization of Special Elements in Output Used by a Downstream Component Affects <= 7.6.10 Patched in 7.6.11
16. Patched Medium · 5.3 wpDiscuz <= 7.6.10 - Insufficient Authorization to Comment Submission on Deleted Posts ↗
    2023-10-20 CVE-2023-46309 Missing Authorization Affects <= 7.6.10 Patched in 7.6.11
17. Patched Medium · 5.4 wpDiscuz <= 7.6.3 - Missing Authorization via AJAX actions ↗
    2023-10-12 CVE-2023-45760 Missing Authorization Affects <= 7.6.3 Patched in 7.6.4
18. Patched High · 8.8 wpDiscuz <= 7.6.5 - Unauthenticated SQL Injection ↗
    2023-09-18 Improper Neutralization of Special Elements used in an SQL Command Affects < 7.6.6 Patched in 7.6.6
19. Patched Medium · 5.3 wpDiscuz <= 7.6.3 - Insecure Direct Object Reference to Post Rating Increase/Decrease ↗
    2023-09-12 CVE-2023-3998 Authorization Bypass Through User-Controlled Key Affects <= 7.6.3 Patched in 7.6.4
20. Patched Medium · 5.3 wpDiscuz <= 7.6.3 - Insecure Direct Object Reference to Comment Rating Increase/Decrease ↗
    2023-09-12 CVE-2023-3869 Authorization Bypass Through User-Controlled Key Affects <= 7.6.3 Patched in 7.6.4
21. Patched Medium · 5.4 Comments – wpDiscuz <= 7.4.2 - Insecure Direct Object References ↗
    2022-10-28 CVE-2022-43492 Authorization Bypass Through User-Controlled Key Affects <= 7.4.2 Patched in 7.5
22. Patched Low · 3.7 Comments - wpDiscuz <= 7.3.11 Sensitive Information Disclosure ↗
    2022-02-10 CVE-2022-23984 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 7.3.11 Patched in 7.3.12
23. Patched Medium · 4.3 Comments - wpDiscuz <= 7.3.3 - Arbitrary Comment Addition/Edition/Deletion by Cross-Site Request Forgery ↗
    2021-10-11 CVE-2021-24806 Cross-Site Request Forgery Affects < 7.3.4 Patched in 7.3.4
24. Patched Medium · 4.8 Comments - wpDiscuz <= 7.3.0 - Authenticated Stored Cross-Site Scripting ↗
    2021-09-13 CVE-2021-24737 Improper Neutralization of Input During Web Page Generation Affects <= 7.3.0 Patched in 7.3.2
25. Patched Critical · 9.8 Comments - wpDiscuz 7.0 - 7.0.4 - Unauthenticated Arbitrary File Upload leading to Remote Code Execution ↗
    2021-06-06 CVE-2020-24186 Unrestricted Upload of File with Dangerous Type Affects 7.0 - 7.0.4 Patched in 7.0.5
26. Patched Critical · 9.8 Comments - wpDiscuz <= 5.3.5 - Blind SQL Injection via order Parameter ↗
    2020-06-12 CVE-2020-13640 Improper Neutralization of Special Elements used in an SQL Command Affects < 5.3.6 Patched in 5.3.6
27. Patched Medium · 6.1 Comments - wpDiscuz <= 3.1.4 - Reflected Cross-Site Scripting ↗
    2016-05-30 Improper Neutralization of Input During Web Page Generation Affects <= 3.1.4 Patched in 3.2.0

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0

Translated into 52 languages, 2 at 90% or more

Plus 28 more locales with partial translations.

Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.

Not measured yet for this plugin’s topics. Its tracked searches are not among the measured topics. See the topics measured so far.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2026-08-23 70K+ → 60K+ down after 120 days in tier
2. 2026-04-25 80K+ → 70K+ down after 973 days in tier
3. 2023-08-26 90K+ → 80K+ down after 18 days in tier
4. 2023-08-08 80K+ → 90K+ up after 3 days in tier
5. 2023-08-05 90K+ → 80K+ down after 672 days in tier
6. 2021-10-02 80K+ → 90K+ up after 62 days in tier
7. 2021-08-01 90K+ → 80K+ down after 92 days in tier
8. 2021-05-01 80K+ → 90K+ up after 273 days in tier

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

Embed this report card

Drop a live Pulse card for Comments – wpDiscuz into a readme, a review or a deck. It updates itself.

Comments – wpDiscuz: 60K+ active installs, 4.7★ (581 reviews). Plugin Pulse (WP Mayor), as of 2026-10-31. https://plugins.wpmayor.com/plugin/wpdiscuz