Comments – wpDiscuz

83 Quality Score

Active Installs

21/30

With 70,000 active installs, wpDiscuz sits in a solid middle tier of comment-related plugins, well behind spam tools like Akismet but ahead of niche alternatives in the same space.

Update Freshness

25/25

Last updated July 2026 and tested with WordPress 7.0, the plugin shows very recent and active maintenance, which is a strong positive signal.

User Rating

14/15

A 94 out of 100 rating across 578 reviews indicates that users who install it tend to be highly satisfied with the experience.

Support Health

8/15

Only 8 support threads with a 50 percent resolution rate is a concern in absolute terms, though the small thread count may simply reflect a low volume of issues rather than poor responsiveness.

WP Compatibility

15/15

Compatibility is excellent, requiring only PHP 7.4 and WordPress 6.0, which keeps the barrier to entry low for most modern hosting environments.

Scores higher than 91% of indexed plugins

About

WordPress comments plugin with AJAX live comments, comment voting, inline feedback, social login and custom comment forms.

Active Installs 60k+

Rating ★★★★½ 4.7/5

Last Updated 2026-09-16 12:25pm GMT

Requires WordPress 6.0+

Tested Up To 7.1.1

Requires PHP 7.4+

Security History

26 known vulnerabilities, all patched

3 Critical 5 High 16 Medium 2 Low

Most recent: September 2, 2026

View details ▸

Comments – wpDiscuz < 7.6.66 - Unauthenticated SQL Injection High

September 2, 2026 Patched in ["7.6.66"] CVE-2026-19704

Comments <= 7.6.56 - Unauthenticated Stored Cross-Site Scripting via 'Website' Field High

July 2, 2026 Patched in ["7.6.57"] CVE-2026-9148

Comments – wpDiscuz <= 7.6.46 - Authenticated (Admin+) Stored Cross-Site Scripting Medium

March 12, 2026 Patched in ["7.6.47"] CVE-2026-22209

wpDiscuz <= 7.6.42 - Unauthenticated Insecure Direct Object Reference Medium

December 25, 2025 Patched in ["7.6.44"] CVE-2025-68997

Comments – wpDiscuz <= 7.6.39 - Unauthenticated Authentication Bypass Through Account Takeover High

December 11, 2025 Patched in ["7.6.40"] CVE-2025-13820

wpDiscuz <= 7.6.33 - Missing Authorization Medium

September 22, 2025 Patched in ["7.6.34"] CVE-2025-59591

Comments – wpDiscuz <= 7.6.24 - Authentication Bypass via WordPress.com OAuth provider Critical

October 24, 2024 Patched in ["7.6.25"] CVE-2024-9488

Comments – wpDiscuz <= 7.6.21 - Unauthenticated HTML Injection Medium

August 1, 2024 Patched in ["7.6.22"] CVE-2024-6704

Comments – wpDiscuz <= 7.6.18 - Authenticated (Contributor+) Stored Cross-Site Scripting Medium

June 6, 2024 Patched in ["7.6.19"] CVE-2024-35681

wpDiscuz <= 7.6.15 - Authenticated (Author+) Stored Cross-Site Scripting via Uploaded Image Alternative Text Medium

April 22, 2024 Patched in ["7.6.16"] CVE-2024-2477

wpDiscuz <= 7.6.12 - Authenticated (Administrator+) Stored Cross-Site Scripting Medium

November 17, 2023 Patched in ["7.6.13"] CVE-2023-51691

wpDiscuz <= 7.6.11 - Unauthenticated Stored Cross-Site Scripting via Comment Uploaded Image Filename High

October 31, 2023 Patched in ["7.6.12"] CVE-2023-47185

wpDiscuz <= 7.6.3 - Authenticated(Author+) Insecure Direct Object Reference Low

October 22, 2023 Patched in ["7.6.4"] CVE-2023-46311

wpDiscuz <= 7.6.10 - Unauthenticated Content Injection Medium

October 22, 2023 Patched in ["7.6.11"] CVE-2023-46310

wpDiscuz <= 7.6.10 - Insufficient Authorization to Comment Submission on Deleted Posts Medium

October 20, 2023 Patched in ["7.6.11"] CVE-2023-46309

wpDiscuz <= 7.6.3 - Missing Authorization via AJAX actions Medium

October 12, 2023 Patched in ["7.6.4"] CVE-2023-45760

wpDiscuz <= 7.6.5 - Unauthenticated SQL Injection High

September 18, 2023 Patched in ["7.6.6"]

wpDiscuz <= 7.6.3 - Insecure Direct Object Reference to Post Rating Increase/Decrease Medium

September 12, 2023 Patched in ["7.6.4"] CVE-2023-3998

wpDiscuz <= 7.6.3 - Insecure Direct Object Reference to Comment Rating Increase/Decrease Medium

September 12, 2023 Patched in ["7.6.4"] CVE-2023-3869

Comments – wpDiscuz <= 7.4.2 - Insecure Direct Object References Medium

October 28, 2022 Patched in ["7.5"] CVE-2022-43492

Comments - wpDiscuz <= 7.3.11 Sensitive Information Disclosure Low

February 10, 2022 Patched in ["7.3.12"] CVE-2022-23984

Comments - wpDiscuz <= 7.3.3 - Arbitrary Comment Addition/Edition/Deletion by Cross-Site Request Forgery Medium

October 11, 2021 Patched in ["7.3.4"] CVE-2021-24806

Comments - wpDiscuz <= 7.3.0 - Authenticated Stored Cross-Site Scripting Medium

September 13, 2021 Patched in ["7.3.2"] CVE-2021-24737

Comments - wpDiscuz 7.0 - 7.0.4 - Unauthenticated Arbitrary File Upload leading to Remote Code Execution Critical

June 6, 2021 Patched in ["7.0.5"] CVE-2020-24186

Comments - wpDiscuz <= 5.3.5 - Blind SQL Injection via order Parameter Critical

June 12, 2020 Patched in ["5.3.6"] CVE-2020-13640

Comments - wpDiscuz <= 3.1.4 - Reflected Cross-Site Scripting Medium

May 30, 2016 Patched in ["3.2.0"]

What It Does

wpDiscuz replaces the default WordPress comment system with an AJAX-powered interface that updates comments in real time as users type and post. It adds features such as comment voting, inline feedback, social login, custom form fields, and subscription options, all without requiring a page refresh. The plugin is designed to make threaded discussions feel faster and more interactive than the native WordPress comment experience.

Who It's For

This plugin is well suited for publishers, blogs, and content sites that get heavy comment traffic and want a more engaging, modern discussion interface than the WordPress default. It fits sites with an active community where voting, subscriptions, and social login would meaningfully increase participation. Editorial teams that want full control over the comment form layout will also benefit from its customization options.

Who Should Skip It

Sites with low comment volume, or those happy with the stock WordPress comment system, will not gain enough value to justify the added complexity. Anyone running a small personal blog or a static brochure site should skip this plugin and keep things lightweight.

The Bottom Line

wpDiscuz delivers a genuinely richer commenting experience than the WordPress default and earns its 83.3 overall score through strong maintenance and very positive user ratings. The one weak spot is support volume, but with only 8 threads on record it is hard to call it a serious problem. If you want faster, more interactive discussions and have the comment traffic to justify it, this is a dependable choice.

Pick Akismet instead if your primary problem is spam comments rather than improving the user experience of the comment form itself.

Antispam Bee 88/100

Choose Antispam Bee if you want strong spam filtering without any reliance on third-party services and prefer a lighter touch than wpDiscuz.

Disable Comments 81/100

Go with Disable Comments if your goal is to shut down commenting entirely across roles or post types rather than enhance it.

Throws SPAM Away 80/100

Pick Throws SPAM Away for a no-configuration spam blocker that strips obvious junk without changing how comments look or behave.

No External Links 79/100

Choose No External Links if link spam in comments is your main pain point and you want to strip or nofollow URLs automatically.