Komentoj – wpDiskuz

Ŝanĝprotokolo

IMPORTANT!

Please remember to delete all caches and purge CDN after the update.

Comments – wpDiscuz v7.6.66 – 27.08.2026

• Security: Fixed an unauthenticated comment disclosure vulnerability in AJAX comment loading. Reported by Jakub Herman via WPScan.

Comments – wpDiscuz v7.6.65 – 25.08.2026

• Added: The Reviews add-on teaser lists the new “Allow guest reviews” option.
• Improved: The settings search shows which email a result belongs to. Eight options are labelled “Email subject” and eight “Email content”, so a search for “email” returned an indistinguishable list; every result now carries its section, such as “Subscription Type: Post new comment”.
• Improved: The settings search also matches those section names, so searching for “mentioned” or “follow confirmation” finds the email templates belonging to them.
• Improved: A settings search result for one of the email templates now opens the accordion holding it, instead of leaving the option hidden behind a collapsed panel.
• Fixed: A settings search result for an option inside a collapsed accordion scrolled to the top of the page instead of to the option, because the scroll measured the option row while it was still hidden and a hidden row reports a position of zero.
• Fixed: Clicking a second settings search result belonging to an accordion that was already open closed it, because the accordion was toggled rather than opened.
• Fixed: The Reviews add-on teaser said the WooCommerce ratings import skips guest reviews. The import includes them.
• Fixed: The Reviews add-on teaser described the review gate as limiting who may submit a review. It sets submitted reviews to pending and does not vet users.
• Added: wpdScrollToOption() is exposed on the window object, so an add-on whose options sit in an accordion of its own can scroll to an option once it has opened it.
• Fixed: The comment editing information printed only the edit icon, without the name of the editor and the time of the edit, on websites whose phrases table does not contain the “Last edited %1$s by %2$s” phrase.
• Improved: Saved phrases are now merged into the default phrases instead of replacing them. Phrases introduced by a plugin update are no longer printed empty on websites where the phrases table has not been filled with them yet, which happens when the plugin is updated without the WordPress dashboard ever being opened.
• Improved: The comment editing information is not printed at all when its phrase is empty, instead of printing a lone edit icon which tells nothing about who edited the comment and when.
• Removed: The Phrases settings page had fields for the VKontakte and Odnoklassniki share button titles. Those share buttons are no longer part of wpDiscuz and the two phrases behind the fields were neither defined nor saved anywhere, so the page raised an “Undefined array key” warning on every load.
• Fixed: Visitors whose email address contains an apostrophe could not subscribe to comments. The address was checked for validity before the backslash WordPress puts in front of the apostrophe was removed, so the subscription form rejected it and reported nothing.
• Fixed: Comment subscriptions were looked up by matching the email address as a SQL pattern instead of comparing it exactly. Since the % and _ characters are allowed in an email address, a subscriber using such an address matched the other subscribers of the same post, received their unsubscribe link, and removed their comment thread subscriptions.

Comments – wpDiscuz v7.6.64 – 07.08.2026

• Improved: Allowed file types and thumbnail sizes are now validated against the known allowed lists when the Content settings are saved, so only values offered by the settings form itself can be stored.
• Improved: Imported options files are now validated before being stored. File types are checked against the mime types WordPress allows to be uploaded, so an edited options file cannot introduce an executable file type. File types provided by add-ons are preserved even when the add-on is not active at the moment of the import.
• Fixed: Searching the settings page for a term containing an apostrophe returned no results.
• Improved: The request sanitizing helpers now return the supplied default value when a request parameter is an array or an object instead of the expected string.
• Removed: An unused method on the add-ons page which read a request parameter without checking that it was set.

Comments – wpDiscuz v7.6.63 – 07.08.2026

Fixed: An issue with comment editing( current_user_can(‘moderate_comments’) ) when comments are closed

Comments – wpDiscuz v7.6.62 – 30.07.2026

• Improved: Additional HTML tag escaping when comment editor phrases are printed into inline JavaScript.
• Fixed: Imported phrase files were not sanitized on upload, unlike phrases saved from the Phrases settings page.
• Fixed: The comments block editor preview could be triggered on the front-end without an editing capability check.

Comments – wpDiscuz v7.6.60/v7.6.61 – 27.07.2026

• Fixed: Stored XSS vulnerability in the comment image URL conversion. Image URLs are now escaped for HTML attribute output. Thanks to hieus for responsibly reporting the issue.
• Fixed: Missing escaping on the custom URL field value and the default avatar image URL.
• Fixed: A leftover debug function call in the default avatar handler.

Comments – wpDiscuz v7.6.59 – 03.07.2026

• Fixed: An issue preventing the proper deletion of attachments.
• Fixed: An Undefined index warning triggered during the active theme file validation check.

Comments – wpDiscuz v7.6.58 – 10.06.2026

• Fixed: Missing escaping issues
• Fixed: Internal images were missing in the combined version of the CSS

Comments – wpDiscuz v7.6.57 – 07.06.2026

• Fixed: Low-severity security issues
• Fixed: Attachment delete AJAX dereferences a missing comment before validation
• Fixed: Bubble live-update AJAX renders arbitrary comment IDs without per-comment authorization
• Fixed: Post-rating AJAX accepts ratings outside the five-star range
• Fixed: Show-replies AJAX dereferences an invalid comment ID without validation