Fancy Comments WordPress

Fancy Comments WordPress has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2026; 2 are fixed and 1 remains unpatched as of October 2026. Their average CVSS score is 6.3, and the most serious one scores 6.4 out of 10.

The most common weakness is Cross-Site Scripting, behind 3 of the records (100%).

2 of the records (67%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2026.

3 independent researchers contributed these findings, one record each.

01234567891013.02.2023Today13.02.20236.4WordPress Fancy Comments <= 1.2.10 - Authenticated (Contributor+) Stored Cross Site Scripting via Shortcode CVSS 6.4 · 13.02.202325.03.20246.4Fancy Comments WordPress <= 1.2.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVSS 6.4 · 25.03.202415.10.20266.1Fancy Comments WordPress <= 1.2.21 - Reflected Cross-Site Scripting CVSS 6.1 · 15.10.2026

Strategic Overview

Avg CVSSMedium
6.3/ 10
Patch Coverage67%
Open

1

Fixed

2

Get automatic notifications for all Fancy Comments WordPress vulnerabilities before they are exploited.

Most severe open issueCVSS 6.1CVE-2026-110384

Fancy Comments WordPress <= 1.2.21 - Reflected Cross-Site Scripting

Read the full analysis

Vulnerability Records

3 records
Showing 1–3 of 3 reports

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C