Known vulnerabilities in Disqus Comment System

Disqus is the web's most popular comment system. Use Disqus to increase engagement, retain readers, and grow your audience.

5Reported vulnerabilities

9.8Highest CVSS score

3.1.4Latest version

30,000+Active installs

What to do now

Update Disqus Comment System to 2.76 or later. 5 of these have a fixed version available. Updating resolves them.

Plugin last updated: January 15, 2026 / Tested up to WordPress: 6.9.7 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
CVE-2014-5347	Medium 6.8	4.9%	2.75 and earlier 2.40 to 2.40 (inclusive) 2.41 to 2.41 (inclusive) 2.42 to 2.42 (inclusive) 2.43 to 2.43 (inclusive) 2.44 to 2.44 (inclusive) 2.45 to 2.45 (inclusive) 2.46 to 2.46 (inclusive) 2.47 to 2.47 (inclusive) 2.48 to 2.48 (inclusive) 2.49 to 2.49 (inclusive) 2.50 to 2.50 (inclusive) 2.51 to 2.51 (inclusive) 2.52 to 2.52 (inclusive) 2.53 to 2.53 (inclusive) 2.54 to 2.54 (inclusive) 2.55 to 2.55 (inclusive) 2.60 to 2.60 (inclusive) 2.61 to 2.61 (inclusive) 2.62 to 2.62 (inclusive) 2.63 to 2.63 (inclusive) 2.64 to 2.64 (inclusive) 2.65 to 2.65 (inclusive) 2.66 to 2.66 (inclusive) 2.67 to 2.67 (inclusive) 2.68 to 2.68 (inclusive) 2.69 to 2.69 (inclusive) 2.70 to 2.70 (inclusive) 2.71 to 2.71 (inclusive) 2.72 to 2.72 (inclusive) 2.73 to 2.73 (inclusive) 2.74 to 2.74 (inclusive)	`2.76`	August 19, 2014
CVE-2014-5346	Medium 6.8	2.7%	2.77 to 2.77 (inclusive)	`2.79`	August 19, 2014
CVE-2014-5345	Medium 4.3	6.1%	2.75 and earlier 2.40 to 2.40 (inclusive) 2.41 to 2.41 (inclusive) 2.42 to 2.42 (inclusive) 2.43 to 2.43 (inclusive) 2.44 to 2.44 (inclusive) 2.45 to 2.45 (inclusive) 2.46 to 2.46 (inclusive) 2.47 to 2.47 (inclusive) 2.48 to 2.48 (inclusive) 2.49 to 2.49 (inclusive) 2.50 to 2.50 (inclusive) 2.51 to 2.51 (inclusive) 2.52 to 2.52 (inclusive) 2.53 to 2.53 (inclusive) 2.54 to 2.54 (inclusive) 2.55 to 2.55 (inclusive) 2.60 to 2.60 (inclusive) 2.61 to 2.61 (inclusive) 2.62 to 2.62 (inclusive) 2.63 to 2.63 (inclusive) 2.64 to 2.64 (inclusive) 2.65 to 2.65 (inclusive) 2.66 to 2.66 (inclusive) 2.67 to 2.67 (inclusive) 2.68 to 2.68 (inclusive) 2.69 to 2.69 (inclusive) 2.70 to 2.70 (inclusive) 2.71 to 2.71 (inclusive) 2.72 to 2.72 (inclusive) 2.73 to 2.73 (inclusive) 2.74 to 2.74 (inclusive)	`2.76`	August 19, 2014
WF-c7476f2c-c32f-4ff7-ad32-70cf68387342	Critical 9.8	—	Before 2.76	`2.76`	June 20, 2014
WF-ec864830-2c8b-4ae4-9c45-3624d0be7d24	High 7.1	—	Before 2.68	`2.68`	December 11, 2011

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.