wpDiscuz Plugin changelog

7.6.75 Latest 4 Nov 2026 2 fixed

Fixed

Security. On some server setups, the comment cache files could be opened directly in a browser. The cache is now stored securely, and old cache files are cleaned up automatically after the update.
When moving a comment to another post, the post search could show no results right after the page loaded. Other addon actions that cancel a request in progress work again too.

7.6.74 29 Oct 2026 1 fixed

Fixed

Security. A commenter whose name contained a placeholder such as {TEXT} could make their comment run JavaScript for moderators viewing it while pending, and for every visitor once it was approved. Names with braces are now shown as plain text. Reported by Patchstack.

7.6.73 25 Oct 2026 1 improved1 fixed

Improved

On the settings page, the preview of an addon that isn't installed described its rating structured data and one shortcode attribute as they used to work. It now matches the current addon.

Fixed

The Facebook login button signed a visitor in through a client-side flow that trusted a Facebook user ID sent with the request, which was not tied to the access token it arrived with. Because an account's Facebook ID doubles as its user name and the account's email address was derived from that ID when Facebook returned none, this could sign a request in as another visitor's account. Facebook l...

7.6.72 7 Oct 2026 2 fixed

Fixed

A comment whose image was refused for its width or height was saved anyway, and the error message was empty. The wpdiscuz_mu_preupload action now fires before the comment is saved, so a file it refuses stops the comment.
The on/off switches on the settings page showed their state by color alone and could not be used from the keyboard. They now show a cross when off and a check mark when on, and can be reached with Tab and toggled with Space. Switches in addon settings tabs get the same fix.

7.6.71 16 Sep 2026 12 fixed

Fixed

The comment bubble and the live comment update never showed comments posted without an email address to visitors who have no email address themselves, visitors who have not commented yet and guests who comment anonymously. A visitor's own new comments are left out of these updates by their email address, and an empty address matched every comment posted without one, so anonymous commenters were...
The new comment message of the comment bubble described the newest comment of the post, even when the bubble was not notifying about that comment, the visitor's own comment or one already on their screen. It now describes the newest comment the visitor is being notified about, and is left out of the response when that comment cannot be read, a private comment an addon keeps from the visitor for...
The Cookies Consent and Agreement checkbox labels were printed on the comment form, and on the comment edit form, without being escaped. The labels are cleaned when the form is saved, but that only applies to what is saved from then on, so a label stored before v7.6.13 kept whatever markup it was given and was still printed as markup to every visitor. The labels are now filtered where they are...
The info icon of the "powered by wpDiscuz" line below the comments carried its behaviour in an inline onclick attribute, which a Content Security Policy that forbids inline script blocks outright, leaving the icon unresponsive with nothing to explain why. It also reached the link through fixed element ids, so a page showing more than one comment form always toggled the first one, and it could n...
The minimal theme carried none of the styles for the "powered by wpDiscuz" line. That stylesheet loads instead of the default theme one rather than alongside it, so the wpDiscuz link was shown permanently and unstyled, and the info icon beside it toggled nothing a reader would notice.
The HTML field printed its markup on the comment form without being filtered. The markup is cleaned when the form is saved, but that only applies to what is saved from then on, so an HTML field stored before v7.6.13 kept whatever markup it was given and was still printed as markup to every visitor, and cloning a form or importing one copies such a value across untouched. It is now filtered wher...
The titles of the comment editor toolbar buttons were passed through the translation function a second time where they are printed, against wpDiscuz's own text domain. The titles are already translated by that point, so the title of a button added by an addon was looked up in a text domain it does not belong to, and a title the addon had already escaped was escaped a second time, which shows th...
The icon height and the tab title of each card on the settings dashboard, and the icon class of the file attachment button on the comment form, were printed without being escaped. All three are supplied through settings arrays and filters an addon can extend, so a value holding a quote or a tag was printed as markup rather than as the value it was meant to be. They are now escaped where they ar...
Replies from guests were rejected as spam on sites where an anti-spam plugin fills in its own hidden fields with JavaScript once the page loads, La Sentinelle for instance, while the first comment posted through the main form went through. A reply form is built by copying the markup of a hidden form on the page, and markup carries the values the page was served with rather than the ones those s...
Every comment a guest posted was rejected while "Detect spambots posting comments" is enabled in All In One Security, stored as spam or discarded depending on its settings. That option rejects a guest comment that arrives without its hidden antibot keys, and it adds those keys only to the comment form WordPress prints itself. wpDiscuz now prints them in its comment, reply and inline feedback fo...
Inline feedback comments were sent without the fields anti-spam plugins add to comment forms. The feedback form is loaded after the page, and those plugins only add their fields to the comment form, so a plugin that treats a missing field as spam, La Sentinelle for instance, rejected every feedback comment from a guest. A feedback comment is now sent with the Akismet and La Sentinelle fields of...
Sending a comment again after it was stored as spam showed WordPress's "Duplicate comment detected" error instead of wpDiscuz's message for a rejected comment. WordPress refuses a comment identical to one it has already stored, spam included, and that refusal was passed on to the commenter as it was. The retry now gets the rejected comment message, "Your comment was not published." by default,...

7.6.70 11 Sep 2026 2 new7 fixed

New

The wpdiscuz_post_rating() template tag prints the standalone Article Rating anywhere in a theme or page builder template, and wpdiscuz_get_post_rating() returns the same HTML. Pass a post ID to display that post's rating with its own form settings, or pass false as the second argument for read-only output. WooCommerce products continue to use WooCommerce's own rating.
The [wpdiscuz_post_rating] shortcode provides the same output for page builders and content editors, with post_id, can_rate, and page_rating attributes. Disable unneeded built-in Article Rating positions to avoid displaying the rating more than once.

Fixed

Vote buttons showed guests the wrong state and tooltip when "Allow Guests to Vote for Comments" is disabled (buttons looked active, or blamed the visitor's IP address, then clicking answered "You Must Be Logged In To Vote").
Guests whose IP address is removed by a privacy plugin or a pre_comment_user_ip filter all shared a single post-rating identity. The first such guest locked the rating for every other one, or overwrote it when "Enable rate editing" is enabled, and they were all counted as one rating in the post average and rating count. Guest rating now requires a usable IP address, the same way comment voting...
The "Enable rate editing" form setting never reached the front-end script, so the confirmation before changing an existing rating was never asked. The form settings were read one line before they were loaded.
Pages displaying more than one Article Rating repeated the wpd-post-rating id and sent every rating click to the post of the page. Each rating is now a .wpd-post-rating element carrying its own post ID, so any eligible post can be rated wherever the wpDiscuz script is loaded. The legacy id remains on the page's own rating at the first checked built-in position, or on a manual placement when no...
The Article Rating schema was repeated whenever the page's own rating appeared more than once. It now follows the rating that owns the legacy id. The template tag's third argument and the shortcode's page_rating attribute can explicitly give or deny a manual placement that ownership when the settings cannot determine it.
"Display ratings on non-singular pages" loaded a stylesheet that did not style the Article Rating block. The standalone rating styles now cover it and use the configured star colours, allowing template-tag and shortcode ratings to display read-only on archives, listings, and other pages where the wpDiscuz script is not loaded when that option is enabled.
Selecting comment attachments more than once replaced the files already selected. New selections now accumulate up to the configured limit, and duplicate files are ignored.

7.6.69 7 Sep 2026 1 improved2 fixed

Improved

The Google social login button now uses the official multicolor Google "G" logo.

Fixed

Logging in with X (Twitter) ended on a blank page showing "0" instead of signing the visitor in. The callback URL and the requested scopes were placed in the authorization request without being URL-encoded.
The Stick and Close actions under a comment on the WordPress Comments page never completed. The requests carried no wpDiscuz nonce, so they were rejected with "Nonce is invalid." and the button spinner kept turning. Both buttons also restore their icon now when a request fails, instead of spinning forever.

7.6.68 3 Sep 2026 2 new2 improved4 fixed1 security

New

The wpdiscuz_comment_rejected_response filter lets moderation plugins provide a clear explanation when a new comment is stored as spam or trash.
The wpdiscuz_hide_readonly_vote_buttons filter hides those buttons again, restoring the wpd-vote-readonly markup used before this release.

Improved

The Phrases screen now identifies the spam and trash rejection fields separately.
Voting buttons now stay visible in a disabled state for visitors who cannot vote on a comment, instead of being hidden. Hiding them left visitors unaware that the site has voting at all. The buttons carry a wpd-vote-disabled class and a tooltip with the reason, and clicking one still shows the existing message.

Fixed

Main and inline comment forms now show a moderation plugin's rejection explanation while keeping the standard wpDiscuz spam or trash phrase when no plugin provides one.
Inline comments stored as spam or trash no longer create subscription records or send mention notifications.
Comment insertion failures, including duplicate-comment and flood checks, now return a valid AJAX error instead of terminating the request with an unusable response.
Plus signs and encoded data are preserved in inline commenter names and email addresses, the comment-author email cookie, and submitted website URLs.

Security

The Google Client Secret is no longer included in the front-end JavaScript settings.

7.6.67 29 Aug 2026 1 new1 improved4 fixed1 changed

New

The wpdiscuz_deny_vote_from_same_ip filter lets site owners show voting buttons and allow votes for same-IP guest comments without changing registered-user voting. Guests on that IP still share one voting identity.

Improved

The voting settings now explain the global request gate and IP-based guest identity, including shared-IP behavior and the login requirement when no visitor IP is available.

Fixed

Registered users can vote independently when they share an IP address, while registered authors are still blocked from voting on their own comments with the correct message.
Guests no longer fall into one shared voting identity when privacy software removes visitor IP addresses. Affected guests must log in to vote even when guest voting is enabled.
Vote totals remain visible when voting buttons are hidden by self-vote restrictions, and wpdiscuz_show_vote can now reliably hide other eligible voting components.
Disabling comment voting now blocks the vote action through both native WordPress AJAX and the custom wpDiscuz AJAX endpoint.

Changed

Note: Existing vote records and totals are preserved; this update changes future voting behavior and does not recalculate historical votes.

7.6.66 27 Aug 2026 1 security

Security

Fixed an unauthenticated comment disclosure vulnerability in AJAX comment loading. Reported by Jakub Herman via WPScan.

7.6.65 25 Aug 2026 2 new5 improved7 fixed1 removed

New

The Reviews add-on teaser lists the new "Allow guest reviews" option.
WpdScrollToOption() is exposed on the window object, so an add-on whose options sit in an accordion of its own can scroll to an option once it has opened it.

Improved

The settings search shows which email a result belongs to. Eight options are labelled "Email subject" and eight "Email content", so a search for "email" returned an indistinguishable list; every result now carries its section, such as "Subscription Type: Post new comment".
The settings search also matches those section names, so searching for "mentioned" or "follow confirmation" finds the email templates belonging to them.
A settings search result for one of the email templates now opens the accordion holding it, instead of leaving the option hidden behind a collapsed panel.
Saved phrases are now merged into the default phrases instead of replacing them. Phrases introduced by a plugin update are no longer printed empty on websites where the phrases table has not been filled with them yet, which happens when the plugin is updated without the WordPress dashboard ever being opened.
The comment editing information is not printed at all when its phrase is empty, instead of printing a lone edit icon which tells nothing about who edited the comment and when.

Fixed

A settings search result for an option inside a collapsed accordion scrolled to the top of the page instead of to the option, because the scroll measured the option row while it was still hidden and a hidden row reports a position of zero.
Clicking a second settings search result belonging to an accordion that was already open closed it, because the accordion was toggled rather than opened.
The Reviews add-on teaser said the WooCommerce ratings import skips guest reviews. The import includes them.
The Reviews add-on teaser described the review gate as limiting who may submit a review. It sets submitted reviews to pending and does not vet users.
The comment editing information printed only the edit icon, without the name of the editor and the time of the edit, on websites whose phrases table does not contain the "Last edited %1$s by %2$s" phrase.
Visitors whose email address contains an apostrophe could not subscribe to comments. The address was checked for validity before the backslash WordPress puts in front of the apostrophe was removed, so the subscription form rejected it and reported nothing.
Comment subscriptions were looked up by matching the email address as a SQL pattern instead of comparing it exactly. Since the % and _ characters are allowed in an email address, a subscriber using such an address matched the other subscribers of the same post, received their unsubscribe link, and removed their comment thread subscriptions.

Removed

The Phrases settings page had fields for the VKontakte and Odnoklassniki share button titles. Those share buttons are no longer part of wpDiscuz and the two phrases behind the fields were neither defined nor saved anywhere, so the page raised an "Undefined array key" warning on every load.

7.6.64 7 Aug 2026 3 improved1 fixed1 removed

Improved

Allowed file types and thumbnail sizes are now validated against the known allowed lists when the Content settings are saved, so only values offered by the settings form itself can be stored.
Imported options files are now validated before being stored. File types are checked against the mime types WordPress allows to be uploaded, so an edited options file cannot introduce an executable file type. File types provided by add-ons are preserved even when the add-on is not active at the moment of the import.
The request sanitizing helpers now return the supplied default value when a request parameter is an array or an object instead of the expected string.

Fixed

Searching the settings page for a term containing an apostrophe returned no results.

Removed

An unused method on the add-ons page which read a request parameter without checking that it was set.

7.6.63 7 Aug 2026 1 fixed

Fixed

An issue with comment editing( current_user_can('moderate_comments') ) when comments are closed

7.6.62 30 Jul 2026 1 improved5 fixed

Improved

Additional HTML tag escaping when comment editor phrases are printed into inline JavaScript.

Fixed

Imported phrase files were not sanitized on upload, unlike phrases saved from the Phrases settings page.
The comments block editor preview could be triggered on the front-end without an editing capability check.
Stored XSS vulnerability in the comment image URL conversion. Image URLs are now escaped for HTML attribute output. Thanks to hieus for responsibly reporting the issue.
Missing escaping on the custom URL field value and the default avatar image URL.
A leftover debug function call in the default avatar handler.

7.6.59 3 Jul 2026 2 fixed

Fixed

An issue preventing the proper deletion of attachments.
An Undefined index warning triggered during the active theme file validation check.

7.6.58 10 Jun 2026 2 fixed

Fixed

Missing escaping issues
Internal images were missing in the combined version of the CSS

7.6.57 7 Jun 2026 5 fixed

Fixed

Low-severity security issues
Attachment delete AJAX dereferences a missing comment before validation
Bubble live-update AJAX renders arbitrary comment IDs without per-comment authorization
Post-rating AJAX accepts ratings outside the five-star range
Show-replies AJAX dereferences an invalid comment ID without validation

7.6.56 27 May 2026 1 fixed

Fixed

Some addons are deactivated after an update on some sites/hosting providers

7.6.55 26 May 2026 5 new6 fixed

New

A new jQuery event 'wpdiscuz_before_send_comment' before ajax request is sent
A new jQuery event 'wpdiscuz_comment_post_success' ajax request is sent, and comment is added
A new jQuery event 'wpdiscuz_comment_post_error' ajax request is sent, but comment adding failed
A new jQuery event 'wpdiscuz_comment_post_failed' ajax request is sent, but unknown error occurred (System Fail, Network Fail, etc)
A new jQuery event 'wpdiscuz comment _post complete' ajax request is sent and complete (This does not state if the comment was added or not, it just fires when the request is complete)

Fixed

An issue with wpDiscuz nonce validation
An issue with WooCommerce integration (The form was not rendered even if the user has bought a product)
An issue with wpDiscuz Ratings regeneration in the tools page
The issues with wpDiscuz tools
An issue with email notifications checking - wc_msg_ip_mismatch
An issue when a comment was approved after editing

7.6.50 2 Apr 2026 2 new1 fixed

New

Load wpDiscuz comments for block themes automatically
Support for attachment preview replace (no need to re-upload all attachments anymore)

Fixed

An issue with wpDiscuz nonce validation

7.6.49 26 Mar 2026 1 fixed

Fixed

The images in the comments were displayed twice.

7.6.48 21 Mar 2026 2 new3 fixed

New

A new filter hook "wpdiscuz_show_vote" to allow hiding/showing vote buttons for certain comments.
A new filter hook "wpdiscuz_post_attachments_as_gallery" to allow controlling whether a post's attachments should be displayed as a gallery or not.

Fixed

Prevent adding unnecessary statistics on comment deletion.
Guests can't vote on guest comments.
Issue with adding nonce in cookies that leads to an issue with nonce verification.

7.6.47 11 Mar 2026 14 security

Security

Unauth Email Notification Flood via wpdCheckNotificationType
Stored XSS in Inline Comment Preview
Shortcode Injection via Email Notifications
Stored XSS via Malicious Options Import
SQL Injection in getAllSubscriptions()
Vote Manipulation via Nonce Oracle and IP Rotation
IP Spoofing in getIP()
Destructive GET Action — Delete All Comments by Email
Options Export Leaks OAuth Secrets in Plaintext
Unsanitized Cookie Email Used as wp_mail() Recipient
XSS via Unescaped Custom CSS in Tag
Unescaped Attachment URLs in HTML Output
Missing Nonce on wpdGetFollowsPage
No Rate Limiting on Subscription Endpoints + LIKE Wildcard Bypass

7.6.46 9 Feb 2026 1 new

New

A new filter hook "wpdiscuz_is_update_nonce_with_ajax" to control nonce ajax requests for guests

7.6.45 19 Jan 2026 1 new

New

A new filter hook "wpdiscuz_validate_nonce_for_guests" to control wpdGetNonce ajax requests for guest users

7.6.44 15 Jan 2026 8 security

Security

Fixed IDOR vulnerability in AJAX actions (CVE-2025-68997)
Added post access authorization check to voteOnComment - uses $comment->comment_post_ID from database, not user-supplied postId (prevents parameter manipulation bypass)
Added server-side rate limiting to AJAX actions (vote 20/min, rate 10/min, follow 15/min, subscribe 10/min)
Rate limiting on voteOnComment, userRate, followUser, addSubscription
Enhanced client fingerprinting (IP + User-Agent + Accept-Language)
Rate limiting executes before nonce validation for maximum protection
Object validation - verifies comment exists and is approved before processing
Post status validation - blocks access to private/password-protected posts for unauthorized users

7.6.43 12 Jan 2026 1 fixed

Fixed

Insecure Direct Object References (IDOR) vulnerability

7.6.51 1 fixed

Fixed

An issue with wpDiscuz nonce validation

7.6.42 23 Dec 2025 1 fixed

Fixed

An issue with inline commenting in Elementor

7.6.41 22 Dec 2025 1 improved

Improved

Added gutenberg toolbar button for inline feedback shortcode generation

7.6.40 9 Dec 2025 1 fixed

Fixed

Disqus login vulnerability

7.6.39 6 Dec 2025 1 new

New

Compatibility with WordPress 6.9

7.6.38 24 Nov 2025 1 fixed

Fixed

Issues with PHP 8.x versions

7.6.37 8 Nov 2025 1 fixed

Fixed

Email notification issue for comments made by anonymous users.

7.6.36 5 Nov 2025 2 fixed

Fixed

Vulnerability in voting actions
Duplicated Gravatars for anonymous users.

7.6.35 25 Oct 2025 1 improved3 removed

Improved

Vk Login to Vk ID login

Removed

Mail.ru and ok.ru social login
Zerospam and postmatic support
Anonymous comment author name and email auto generation

7.6.34 19 Sep 2025 3 fixed

Fixed

An issue during the plugin deactivation
An issue with 'Enable subscription bar' option
An issue with caching

7.6.33 29 Jun 2025 1 fixed

Fixed

Avatars compatibility issue with wpForo

7.6.32 24 Jun 2025 1 fixed

Fixed

An error when getting users' avatars

7.6.31 22 Jun 2025 2 fixed

Fixed

Potential security issue
Issue with BuddyPress uploaded avatars

wpDiscuz Plugin changelog

2026 27 versions

Undated 1 version

2025 12 versions

Uptime status page