EUVD-2026-54378
GHSA-v3mq-vj7f-qxwx
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-accessible stored XSS; no authentication required to plant payload; victim page view required; scope change reflects browser execution crossing trust boundary; no availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Comments WordPress plugin before 7.6.60 does not properly escape a user-supplied URL before outputting it inside an HTML attribute, allowing unauthenticated users to store a Cross-Site Scripting payload that executes in the browser of any user, including administrators, who views the affected content.
AnalysisAI
Stored Cross-Site Scripting in the Comments WordPress plugin (all versions before 7.6.60) permits unauthenticated attackers to permanently inject malicious JavaScript into the site database by submitting a crafted URL that the plugin fails to escape before rendering inside an HTML attribute. Any authenticated user - including site administrators - who subsequently views the affected content triggers payload execution in their browser, potentially enabling session hijacking and full site takeover. A publicly available exploit is referenced via WPScan, though EPSS at 0.17% (7th percentile) indicates low observed exploitation volume at time of analysis, and the vulnerability is not listed in CISA KEV.
Technical ContextAI
The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting), specifically the stored/persistent variant. The Comments plugin for WordPress accepts a user-supplied URL value as part of comment submission and embeds it directly inside an HTML attribute without adequate output encoding or sanitization. This allows an attacker to break out of the attribute context using unescaped quotation marks or inject a javascript: URI scheme, executing arbitrary JavaScript when the rendered page is loaded. The CPE string cpe:2.3:a:unknown:comments:*:*:*:*:*:*:*:* reveals the vendor attribution in NVD is unresolved, placing authoritative plugin identification with the WPScan database. The CVSS scope-change flag (S:C) reflects that the payload executes in a browser context distinct from the server, which is the standard XSS trust boundary crossing.
RemediationAI
The primary fix is to upgrade the Comments WordPress plugin to version 7.6.60 or later, which resolves the URL escaping defect; administrators should apply this update immediately via the WordPress dashboard or WP-CLI. The patch is confirmed available per the WPScan advisory at https://wpscan.com/vulnerability/e77ea3fb-4d38-4fa7-a50b-1a0078f34474/. If immediate patching is not feasible, disabling the Comments plugin entirely eliminates the attack surface at the cost of removing commenting functionality from the site. Restricting comment submission to logged-in users (via WordPress Settings > Discussion) raises the attacker bar from unauthenticated to at least subscriber-level, reducing but not eliminating risk. Deploying a Web Application Firewall rule to block common XSS patterns in comment fields may reduce exposure, but encoding bypasses make this an unreliable standalone control. A Content Security Policy (CSP) header that disallows inline scripts and restricts script sources provides meaningful defense-in-depth against payload execution even if the stored content reaches the page.
SQL injection in the Comments WordPress plugin before 7.6.66 allows unauthenticated remote attackers to read restricted
An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. Rated medium severity (CVSS 6.5), this vulner
An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. Rated medium severity (CVSS 5.4), this vulner
An issue was discovered in the Comments plugin before 1.5.6 for Craft CMS. Rated medium severity (CVSS 5.4), this vulner
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today