Genial Comments

Genial Comments has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2024; all 2 are fixed as of October 2026. Their average CVSS score is 4.3, and the most serious one scores 4.3 out of 10.

The most common weakness is Missing Authorization, behind 2 of the records (100%).

Every one of the 2 issues recorded for Genial Comments has a vendor fix available, so running the current release closes all known holes.

All of these findings were reported by Friday. Genial Comments is installed on roughly 4,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

Strategic Overview

Avg CVSSMedium
4.3/ 10
Patch Coverage100%
Open

0

Fixed

2

Get automatic notifications for all Genial Comments vulnerabilities before they are exploited.

Highest severity on recordCVSS 4.3CVE-2024-32689

WP Social Comments <= 1.7.3 - Missing Authorization via wpfc_allow_comments()

Read the full analysis

Vulnerability Records

2 records
Genial Comments banner
Latestv1.8.3

Genial Comments

GenialSouls

Author

GenialSouls

4.8(20)
96/100
Last Updated
2026-10-23 (4d ago)
Active Installs
4,000+
Downloads
170,035
Requires WP
4.7+
Requires PHP
7.4+
Tested up to
WP 7.1.3
Created
2017-11-08 (9y ago)

Genial Comments lets you add Disqus-powered discussions or use your WordPress theme’s built-in commenting system. Choose your preferred provider, configure comment loading, and optionally customize the appearance of native WordPress comments. Disqus supports privacy-aware loading options, including click-to-load, viewport-based loading, and immediate loading. WordPress Native Comments uses your theme’s existing comment area and WordPress’s built-in moderation and Discussion settings. Legacy Facebook Comments settings are preserved for compatibility. Meta discontinued the Facebook Comments Plugin in February 2026, so Facebook commenting is no longer functional. Features Disqus Add Disqus-powered discussions using your Disqus shortname. Choose click-to-load, viewport-based, or immediate loading. Disqus is an external service and may receive page and visitor information when comments are loaded. Disqus Basic may display advertising; see External services below. WordPress Native Comments Use WordPress’s existing comments without an external account. Comment placement remains controlled by your active theme or template. WordPress continues to manage moderation and Discussion settings. Existing replies and threaded comments remain part of WordPress’s comment system. The plugin does not insert a second native comments area. Optional Native Appearance Styling is disabled by default; Default preserves your theme’s existing styling. Modern and Minimal presets provide optional visual styling. Choose Blue, Green, Purple, or Neutral accent colors with an appearance preset. Results depend on the active theme and its comment markup; universal theme compatibility is not claimed. Compatibility Existing Facebook settings and provider settings are preserved when switching providers. The existing [gs-fb-comments] shortcode remains available for external providers. Switching providers does not delete or migrate WordPress comments. External services The legacy Facebook provider may request Meta’s Facebook JavaScript SDK at connect.facebook.net and, when its optional cache-refresh setting is enabled, send the public post URL to Meta’s developer debugger endpoint. Meta’s service may receive the visitor’s IP address, browser information, page URL, referrer, cookies, account state, locale, and optional App ID. Meta discontinued the Facebook Comments Plugin in February 2026, so this legacy integration no longer provides functional Facebook comments. Review Meta’s policies: Meta Platform Terms Meta Privacy Policy When Disqus is selected, this plugin loads the Disqus Universal Embed script from the configured HTTPS Disqus shortname when comments are activated by the selected loading mode. Disqus may receive information about the page and visitor, and Disqus Basic may display advertising. Review the Disqus policies: Disqus Terms Disqus Privacy Policy WordPress Native Comments uses the site’s own WordPress installation and does not connect to an external commenting service.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C