Better Comments
Better Comments has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2024; all 2 are fixed as of September 2026. Their average CVSS score is 5.4, and the most serious one scores 6.4 out of 10. 2024 was the busiest year with 2 disclosures.
The most common weakness is Cross-Site Scripting, behind 2 of the records (100%).
Every one of the 2 issues recorded for Better Comments has a vendor fix available, so running the current release closes all known holes.
All of these findings were reported by Nicolo. Better Comments is installed on roughly 10 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
CVE-2024-2404Better Comments <= 1.5.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records

Better Comments
Author
Matt Biscay
Your theme looks great—until you reach the comments. Better Comments gives you a clean set of controls for the comment form, comments, reply links, and avatars. No custom CSS required, no replacement comment platform, and no changes to your existing comments. Why Better Comments? Give the comment form the same visual language as the rest of your site. Make comment cards, reply links, fields, and focus states feel intentional. Choose an avatar shape that fits your brand, from circles to polygons and stars. Let registered users upload a custom avatar from their profile. Improve smaller screens without rebuilding your theme’s comment template. Keep WordPress native: your comments, hooks, filters, and moderation workflow stay in place. Keep the frontend lean: assets load only where comments are displayed, and generated styles are cached. Better Comments Pro One plan. Everything premium. Pro adds the tools you need when comments are part of your editorial workflow: Format comments with frontend and WordPress admin quicktags. Add custom quicktags for your own publishing workflow. Allow oEmbeds in comments. Let administrators comment on posts with comments closed. Redirect comment archive and replytocom URLs to cleaner destinations. Add missing ALT text to Gravatar images. Get priority support. See Better Comments Pro
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C