Better Comments

Better Comments has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2024; all 2 are fixed as of September 2026. Their average CVSS score is 5.4, and the most serious one scores 6.4 out of 10. 2024 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Scripting, behind 2 of the records (100%).

Every one of the 2 issues recorded for Better Comments has a vendor fix available, so running the current release closes all known holes.

All of these findings were reported by Nicolo. Better Comments is installed on roughly 10 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium
5.4/ 10
Patch Coverage100%
Open

0

Fixed

2

Get automatic notifications for all Better Comments vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.4CVE-2024-2404

Better Comments <= 1.5.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

2 records
Better Comments banner
Latestv3.0.0

Better Comments

Matt Biscay

Author

Matt Biscay

3.5(2)
70/100
Last Updated
2026-08-11 (1mo ago)
Active Installs
10+
Downloads
3,203
Requires WP
5.2+
Requires PHP
8.0+
Tested up to
WP 7.1
Created
2020-10-09 (6y ago)

Your theme looks great—until you reach the comments. Better Comments gives you a clean set of controls for the comment form, comments, reply links, and avatars. No custom CSS required, no replacement comment platform, and no changes to your existing comments. Why Better Comments? Give the comment form the same visual language as the rest of your site. Make comment cards, reply links, fields, and focus states feel intentional. Choose an avatar shape that fits your brand, from circles to polygons and stars. Let registered users upload a custom avatar from their profile. Improve smaller screens without rebuilding your theme’s comment template. Keep WordPress native: your comments, hooks, filters, and moderation workflow stay in place. Keep the frontend lean: assets load only where comments are displayed, and generated styles are cached. Better Comments Pro One plan. Everything premium. Pro adds the tools you need when comments are part of your editorial workflow: Format comments with frontend and WordPress admin quicktags. Add custom quicktags for your own publishing workflow. Allow oEmbeds in comments. Let administrators comment on posts with comments closed. Redirect comment archive and replytocom URLs to cleaner destinations. Add missing ALT text to Gravatar images. Get priority support. See Better Comments Pro

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C