plugin
6 known security issues reported for the Hypercomments WordPress plugin. Most recent disclosed Jun 4, 2025.
Running Hypercomments on your site? Check whether your installed version is affected.
Scan your site freeThe HyperComments plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the hc_request_handler function in all versions up to, and including, 1.2.2. This makes it possible for unauthenticated attackers to update arbitrary optio...
The HyperComments plugin for WordPress is vulnerable to Arbitrary File Deletion via the 'xml' GET parameter in versions up to, and including, 1.2.2. This makes it possible for unauthenticated attackers to delete files on the vulnerable filesystem.
Unauthenticated Arbitrary File Deletion vulnerability found by Lenon Leite in WordPress HyperComments plugin (versions <= 1.2.2).
The HyperComments plugin for WordPress is vulnerable to Arbitrary File Deletion via the 'xml' GET parameter in versions up to, and including, 1.2.2. This makes it possible for unauthenticated attackers to delete files on the vulnerable filesystem.
The plugin does not validate and sanitise user input which is being concatenated to create a file path, passed to unlink(), which leads to an arbitrary file deletion issue. For more details about this issue, please see the reference.
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free