Description

The Comments WordPress plugin before 7.6.60 does not properly escape a user-supplied URL before outputting it inside an HTML attribute, allowing unauthenticated users to store a Cross-Site Scripting payload that executes in the browser of any user, including administrators, who views the affected content.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-07T06:16:55.003Z",
  "pubdate": "2026-08-07T06:16:55.003Z",
  "executiveSummary": "The The Comments WordPress plugin before 7.6.60 suffers from a Stored Cross-Site Scripting (XSS) vulnerability stemming from insufficient input sanitization and output encoding of user-supplied URLs.\nThis security flaw enables unauthenticated malicious actors to inject arbitrary JavaScript payloads into comment fields, which are subsequently persisted within the application database.\nWhen an unsuspecting victim or administrative user accesses the affected web pages containing the malicious comment, the injected script executes within the context of their active browser session.\nSuccessful exploitation of this vulnerability can lead to severe security implications, including session hijacking, unauthorized administrative action execution, defacement, and potential compromise of the underlying WordPress environment.\nThe attack vector requires network access to the target WordPress instance but does not demand prior authentication or specialized privileges, making it accessible to external threat actors.\nRisk mitigation necessitates immediate application of vendor-supplied patches by updating the vulnerable The Comments plugin to version 7.6.60 or higher.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling of user-supplied URL inputs within the The Comments WordPress plugin prior to version 7.6.60.\nWhen a user submits input intended for a URL attribute, the plugin fails to perform adequate context-aware output encoding or rigorous input sanitization before rendering the value inside an HTML attribute.\nThis architectural oversight permits the injection of malicious markup, specifically Cross-Site Scripting payloads encapsulated within crafted URI schemes or event handlers, which are then stored persistently in the database.\nThe attack flow begins when an unauthenticated attacker crafts an HTTP request containing a malicious payload disguised as a legitimate URL submission via the comment interface of the vulnerable component.\nThe application accepts the malicious string without proper validation and writes the record directly to the database.\nSubsequently, when any visitor or privileged administrator retrieves the page containing the malicious comment, the server outputs the unescaped payload directly into the Document Object Model (DOM) inside an HTML attribute.\nThe victim's web browser parses the response and executes the embedded JavaScript payload in the context of the vulnerable origin.\nBecause administrative users frequently review comment queues and moderation interfaces, the execution of arbitrary script code in their browser session can facilitate privilege escalation through automated administrative actions, such as the creation of malicious administrator accounts or modification of core site settings.\nThe vulnerability affects all versions of the The Comments plugin prior to 7.6.60, requires zero authentication or privilege requirements to exploit, and is exploitable over the network via standard HTTP/HTTPS channels."
}