WP-CommentNavi

WP-CommentNavi has one disclosed vulnerability in the WordSec catalog, all reported in 2023; it is fixed as of September 2026. Their average CVSS score is 5.5, and the most serious one scores 5.5 out of 10.

The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).

The one issue recorded for WP-CommentNavi has a vendor fix available, so running the current release closes it.

All of these findings were reported by Rio Darmawan. WP-CommentNavi is installed on roughly 700 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSMedium
5.5/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all WP-CommentNavi vulnerabilities before they are exploited.

Highest severity on recordCVSS 5.5CVE-2023-22715

WP-CommentNavi <= 1.12.1 - Authenticated (Admin+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

1 records
WP-CommentNavi banner
Latestv2.0.0

WP-CommentNavi

Lester Chan

Author

Lester Chan

5.0(2)
100/100
Last Updated
2026-08-09 (1mo ago)
Active Installs
700+
Downloads
65,806
Requires WP
6.8+
Requires PHP
8.2+
Tested up to
WP 7.0.4
Created
2008-11-04 (18y ago)

Replaces the plain &larr; Older Comments | Newer Comments &rarr; links with numbered page links. Example: Page 1 of 20: [1] 2 3 4 ... Last It is the comment-thread counterpart of WP-PageNavi, and the two are deliberately built the same way, down to the names of the filters that change the class names. The plugin icon is by Freepik from Flaticon. Features Numbered page links instead of two prev/next links A drop-down list style, for threads with a great many pages Every piece of the navigation’s text is configurable, including inline SVG arrows Larger page numbers — 10, 20, 30 — for jumping across a long thread Ten filters for the element class names, one for the finished markup One stylesheet that serves both left-to-right and right-to-left locales, restyled with two CSS custom properties Donations I spent most of my free time creating, updating, maintaining and supporting these plugins, if you really love my plugins and could spare me a couple of bucks, I will really appreciate it. If not feel free to use it without any obligations. Usage The template tag reads figures that WordPress only populates inside comments_template(), so it belongs in comments.php and produces nothing anywhere else. It also accepts an array of arguments: <?php wp_commentnavi( array( 'wrapper_tag' => 'nav', 'wrapper_class' => 'my-comment-nav', 'options' => array( 'num_pages' => 3 ), ) ); ?> Pass 'echo' => false to get the markup back as a string instead of printing it. Changing the CSS The navigation inherits its font and its colours from your theme, and the two colours it does set are CSS custom properties, so the usual way to restyle it is to set those in your theme’s style.css: :root { --wp-commentnavi-border-color: #d0d0d0; --wp-commentnavi-border-color-current: #c0392b; } If you need to change more than that, copy css/wp-commentnavi.css out of the plugin directory into your theme’s directory as wp-commentnavi.css and edit it there. Your changes then survive plugin updates, and a copy in a child theme wins over one in the parent theme. Alternatively, set Use wp-commentnavi.css to No on the settings screen and write the styles yourself. Changing Class Names These filters change the class names assigned to the navigation elements: wp_commentnavi_class_pages wp_commentnavi_class_first wp_commentnavi_class_previouscommentslink wp_commentnavi_class_extend wp_commentnavi_class_smaller wp_commentnavi_class_page wp_commentnavi_class_current wp_commentnavi_class_larger wp_commentnavi_class_nextcommentslink wp_commentnavi_class_last Other Filters wp_commentnavi — the complete markup, before it is printed wp_commentnavi_allowed_html — the tags allowed inside the navigation text settings wp_commentnavi_capability — the capability required to reach the settings screen, manage_options by default add_filter( 'wp_commentnavi_capability', function ( $capability, $context ) { return 'edit_pages'; }, 10, 2 );

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C