AnyComment vulnerabilities

1 known vulnerability in AnyComment from Ateshabaev. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.2 High severity

  AnyComment: Improper Neutralization of Input During Web Page Generation

  CVE-2026-103422Oct 14, 2026Ateshabaev

  The AnyComment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 0.3.6. This is due to insufficient input sanitization on the public /wp-json/anycomment/v1/subscribe REST endpoint and