DX Unanswered Comments

DX Unanswered Comments has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of August 2026. Their average CVSS score is 4.3, and the most serious one scores 4.3 out of 10.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (100%).

The one issue recorded for DX Unanswered Comments has a vendor fix available, so running the current release closes it.

All of these findings were reported by afnaan. DX Unanswered Comments is installed on roughly 20 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.

Strategic Overview

Avg CVSSMedium

4.3/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all DX Unanswered Comments vulnerabilities before they are exploited.

Highest severity on recordCVSS 4.3CVE-2026-4138

DX Unanswered Comments <= 1.7 - Cross-Site Request Forgery via Settings Update

Read the full analysis

Vulnerability Records

1 records


2026-04-21 19:05	DX Unanswered Comments <= 1.7 - Cross-Site Request Forgery via Settings Update DX Unanswered Comments <= 1.7	`CVE-2026-4138`	4.3 Medium	afnaan	Yes

Showing 1–1 of 1 reports

Latestv1.8

DX Unanswered Comments

Author

Mario Peshev

3.4(5)

68/100

Last Updated

2026-04-21 (4mo ago)

Active Installs

20+

Downloads

4,746

Requires WP

5.6+

Requires PHP

Tested up to

WP 6.9.7

Created

2013-09-25 (13y ago)

Filter your admin comments that have not received a reply by internal user yet. Ignore pingbacks from the loop. You could define a list with admin usernames that would answer from your team.

View on WordPress.org