AnyComment

AnyComment has 9 disclosed vulnerabilities in the WordSec catalog, reported between 2018 and 2026; 5 are fixed and 4 remain unpatched as of October 2026. Their average CVSS score is 6.4, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 3 high. 2025 was the busiest year with 3 disclosures.

The most common weakness is Cross-Site Scripting, behind 3 of the records (33%). Other recurring categories include Cross-Site Request Forgery (CSRF), Missing Authorization.

5 of the records (56%) have a vendor fix, while 4 remain unpatched. The oldest unresolved one dates back to 2025.

5 independent researchers contributed these findings, most of them (3) reported by Brandon James Roldan (tomorrowisnew).

Strategic Overview

Avg CVSSMedium

6.4/ 10

Patch Coverage56%

Open

Fixed

Get automatic notifications for all AnyComment vulnerabilities before they are exploited.

Most severe open issueCVSS 8.1CVE-2025-60240

AnyComment <= 0.3.6 - Unauthenticated Local File Inclusion

Read the full analysis

Vulnerability Records

9 records


2026-10-13 14:19	AnyComment <= 0.3.6 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter AnyComment <= 0.3.6	`CVE-2026-103422`	7.2 High	Kevin Whelan	No
2025-12-31 00:00	AnyComment <= 0.3.6 - Missing Authorization AnyComment <= 0.3.6	`CVE-2025-62874`	4.3 Medium	Rooting	No
2025-10-08 00:00	AnyComment <= 0.3.6 - Authenticated (Subscriber+) SQL Injection AnyComment <= 0.3.6	`CVE-2025-48091`	6.5 Medium	Rooting	No
2025-07-12 00:00	AnyComment <= 0.3.6 - Unauthenticated Local File Inclusion AnyComment <= 0.3.6	`CVE-2025-60240`	8.1 High	Nguyen Xuan Chien	No
2023-07-18 00:00	Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get AnyComment <= 0.0.98	`CVE-2023-33999`	6.1 Medium	Rafie Muhammad	Yes
2022-01-19 00:00	AnyComment <= 0.2.17 - Race Condition AnyComment < 0.2.18	`CVE-2022-0279`	5.3 Medium	Brandon James Roldan (tomorrowisnew)	Yes
2022-01-19 00:00	AnyComment <= 0.2.17 - Cross-Site Request Forgery AnyComment < 0.2.18	`CVE-2022-0134`	8.8 High	Brandon James Roldan (tomorrowisnew)	Yes
2021-12-20 00:00	AnyComment <= 0.3.4 - Open Redirect via redirect parameter AnyComment < 0.3.5	`CVE-2021-24838`	5.4 Medium	Brandon James Roldan (tomorrowisnew)	Yes
2018-07-17 00:00	AnyComment <= 0.0.32 - Cross-Site Scripting AnyComment <= 0.0.32	`CVE-2018-21001`	6.1 Medium	Anonymous	Yes

Showing 1–9 of 9 reports