Lazy Social Comments
Lazy Social Comments has one disclosed vulnerability in the WordSec catalog, all reported in 2023; it is fixed as of October 2026. Their average CVSS score is 4.4, and the most serious one scores 4.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for Lazy Social Comments has a vendor fix available, so running the current release closes it.
All of these findings were reported by yuyudhn. Lazy Social Comments is installed on roughly 900 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.8.11.
CVE-2023-23733Lazy Social Comments <= 2.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Options
Read the full analysisVulnerability Records

Lazy Social Comments
Author
Joel James
⚠️ This plugin has been discontinued and will not receive further updates. Facebook (Meta) permanently shut down the Facebook Comments embed (along with other social plugins) on February 10, 2026. Since this plugin’s only purpose was to lazy load the Facebook Comments embed, it can no longer function. This is a Facebook decision and there is no workaround. What this final version does Removes all Facebook Comments code from your site. Restores native WordPress comments automatically. Shows an admin notice explaining the situation. What you should do Deactivate and delete this plugin. Your site will continue using native WordPress comments. Want a modern comment section again? Try Convocept, described below. Important note about old comments Comments posted through Facebook Comments were stored by Facebook, not in your WordPress database. They cannot be exported or recovered. Looking for an alternative? Try Convocept Convocept is a free, fast, native comment system from the same team. It gives your readers a modern comment section — threaded replies, upvotes, email subscriptions and moderation tools — and it is built so that what happened with Facebook Comments cannot happen to your comments again: Your comments stay on your site. Every comment is a normal WordPress comment in your own database. No outside service holds them, so no outside service can switch them off. Fast like this plugin was. Convocept loads no JavaScript until readers reach the comments, so the comment section never slows down the page. No account needed. Readers comment with a name and email, as in WordPress. No Facebook login, no third-party tracking. Works with the comments you have now. This final version already switched your site back to native WordPress comments; Convocept shows them in its new design the moment you activate it. Learn more at convocept.com. Thank you to everyone who used this plugin over the years. ❤️
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C