FV Thoughtful Comments
FV Thoughtful Comments has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it is fixed as of September 2026. Their average CVSS score is 3.1, and the most serious one scores 3.1 out of 10.
The most common weakness is Missing Authorization, behind 1 of the records (100%).
The one issue recorded for FV Thoughtful Comments has a vendor fix available, so running the current release closes it.
All of these findings were reported by Kévin Mosbahi (Mika). FV Thoughtful Comments is installed on roughly 70 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.7.7.
CVE-2025-24613FV Thoughtful Comments <= 0.3.5 - Missing Authorization
Read the full analysisVulnerability Records
FV Thoughtful Comments
Author
FolioVision
We’ve always found the comment moderation/management a bit weak (no wonder so many people are using the Disqus crutch). Our plugin Thoughtful Comments supercharges comment moderation by moving it into the front end (i.e. in context). It also allows banning by IP, email address or domain. Unlike many comment plugins, Thoughtful Comments works hand in hand with Akismet, feeding all the information into Akismet as well as the existing WordPress whitelist and blacklist features. What’s cool about Thoughtful Comments is that you can add it to a WordPress site with no changes to existing comment moderation tables and you can remove it from a WordPress site with no loss of core functionality. I.e. I think Thoughtful Comments could be integrated into core with a minimum amount of pain. Thoughtful Comments works with all current Subscribe to Comment plugins as well. As we use all core functions and tables, Thoughtful Comments works with all current Subscribe to Comment plugins as well. Thoughtful Comments is the most powerful and useful code we’ve ever written (we have four very popular plugins). It’s integration into core would save many, many site owners the pain of Disqus. Thoughtful Comments is entirely stable and active on some of the most heavily commented political and lifestyle sites in the world. While Automattic has a horse in the ring (Intense Debate), we’d really like to see Thoughtful Comments included in core. Features: Front-end comment moderation – for logged in users with required permission Unapproved comments shown in front-end – for logged in users with required permission Per-user moderation settings Comment caching – lightening PHP load and speeding up busy sites significantly – works with any WP cache plugin! Download now! Support | Change Log | Installation | Usage Theme compatibility If you want to get the most correct display when deleting a comment and preserving it’s replies, you need to use a theme which is using “cascade” display of the comments instead of “nested” display. Thoughtful Comments assumes that each comment is contained in some HTML element with unique ID which is containing the comment ID, so it works with most of the themes. Also, commenter name should not be in cite tag, so that the HTML highlight will appear properly and not as readable HTML (similar to code tag).
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C