=== Comments - wpDiscuz ===
Contributors: gVectors Team
Tags: comment, comments, ajax comments, comment form, comment fields
Requires at least: 5.0
Tested up to: 6.9
Stable tag: 7.6.54
Requires PHP: 5.6
License: GPLv3
License URI: https://www.gnu.org/licenses/gpl-3.0.html

AJAX powered realtime comments. Designed to extend WordPress native comments. Custom comment forms/fields. Making comments has never been so awesome!

== Description ==

AJAX realtime comment system with custom comment form and fields. Designed to supercharge WordPress native comments. Super fast and responsive with dozens of features. This is the best alternative to Disqus and Jetpack Comments, if you want to keep your comments in your database.

wpDiscuz version 7 is a revolutionary perspective on the commenting world! This plugin changes your website commenting experience and provides you with new user engagement features. It’s totally improved with brand new innovative features bringing live to your website.


* wpDiscuz Demo: [https://wpdiscuz.com/](https://wpdiscuz.com/)
* Support Forum: [https://wpdiscuz.com/community/](https://wpdiscuz.com/community/)
* wpDiscuz GDPR: [https://wpdiscuz.com/gdpr/](https://wpdiscuz.com/gdpr/)
* wpDiscuz Addons: [https://wpdiscuz.com/addons/](https://wpdiscuz.com/addons/)
* wpDiscuz Documentation: [https://wpdiscuz.com/docs/](https://wpdiscuz.com/docs/)
* wpDiscuz Addons Bundle: [https://gvectors.com/product/wpdiscuz-addons-bundle/](https://gvectors.com/product/wpdiscuz-addons-bundle/)

= Comments - wpDiscuz Features =

* Three nice and modern comment layouts
* Brings fastest commenting experience (boosted core)
* Adds interactive comment box on posts and other content types
* Inline commenting and feedback. Commenting on post content.
* Live Notification with real-time updating Comment Bubble.
* Social Commenting with lots of Social login options
* Post Rating. Allows to rate posts directly on rating stars.
* Commenting can be allowed/disallowed on posts and other content types
* Responsive comments form and comment threads design
* Clean, simple and easy user interface and user experience
* Comment list sorting by newest, oldest and most voted comments
* Anonymous comments ( name and email can be set as not required )
* Full integration with Social Network Login plugins (Facebook, Twitter...)
* Multi-level (nested) comment threads, with maximum levels depth setting option
* Allows to create a new discussion thread and reply to existing comment
* Ajax button "Load More Comments" instead of simple comments pagination
* Lazy load wpDiscuz comments on scrolling
* Different comment date formats, reflects Wordpress date format settings
* Logged in users and guests can edit their comments (time-frame can be limited by admin)
* Automatic URLs to link conversion in comment texts
* Automatic image source URLs to image (HTML) conversion in comment texts
* Long comment text breaking function ("Read more" button)
* Multiple line-breaks (limited by Wordpress comment filter)
* Comment author notification options with special checkboxes on comment form
* Subscription activation via additional "Confirm Subscription" email
* Ability to add comment system on attachment pages if it's allowed by Wordpress
* Fast and easy comment form with ajax validation and data submitting
* Fully integrated and compatible with Wordpress
* Uses Wordpress Comment system with all managing functions and features
* Secure and Anti-Spam features will not allow spammers to comment
* Comment voting with positive and negative result
* Smart voting system with tracking by logged-in user and cookies
* Quick Tags on comment form textarea
* Custom Comment Forms with custom fields
* Rating shortcode for posts via comment custom field [wpdrating] with a lot of attributes
* Option to overwrite comment template and style
* Highlighting new comments since last visit with different background
* Notification to comment author when comment was approved
* Display only parent comments with view replies (x) button
* Control commenters by roles (allow/restrict access to website comment area)
* Option to load all comments on first page load
* Built-in Gravatar caching
* Sticky Comments
* Closed Comments Threads (disable replies)
* Subscribe to User / User Follow
* Built-in comment and comment author caching system


= Add-ons =

* | [wpDiscuz - Bundle](https://gvectors.com/product/wpdiscuz-addons-bundle/)
* | [wpDiscuz - Emoticons](https://gvectors.com/product/wpdiscuz-emoticons/)
* | [wpDiscuz - User Notifications](https://gvectors.com/product/wpdiscuz-user-notifications/)
* | [wpDiscuz - Media Uploader](https://gvectors.com/product/wpdiscuz-media-uploader/)
* | [wpDiscuz - Embeds](https://gvectors.com/product/wpdiscuz-embeds/)
* | [wpDiscuz - Comment Author Info](https://gvectors.com/product/wpdiscuz-comment-author-info/)
* | [wpDiscuz - Google ReCaptcha](https://gvectors.com/product/wpdiscuz-recaptcha/)
* | [wpDiscuz - myCRED Integration](https://gvectors.com/product/wpdiscuz-mycred/)
* | [wpDiscuz - Widgets](https://gvectors.com/product/wpdiscuz-widgets/)
* | [wpDiscuz - Front-end Moderation](https://gvectors.com/product/wpdiscuz-frontend-moderation/)
* | [wpDiscuz - Subscription Manager](https://gvectors.com/product/wpdiscuz-subscribe-manager/)
* | [wpDiscuz - Comment Search](https://gvectors.com/product/wpdiscuz-comment-search/)
* | [wpDiscuz - Comment Report and Flagging](https://gvectors.com/product/wpdiscuz-report-flagging/)
* | [wpDiscuz - Ads Manager](https://gvectors.com/product/wpdiscuz-ads-manager/)
* | [wpDiscuz - User & Comment Mentioning](https://gvectors.com/product/wpdiscuz-user-comment-mentioning/)
* | [wpDiscuz - Advanced Likers](https://gvectors.com/product/wpdiscuz-advanced-likers/)
* | [wpDiscuz - Online Users](https://gvectors.com/product/wpdiscuz-online-users/)
* | [wpDiscuz - Private Comments](https://gvectors.com/product/wpdiscuz-private-comments/)
* | [wpDiscuz - Syntax Highlighter](https://gvectors.com/product/wpdiscuz-syntax-highlighter/)
* | [Comments Censure PRO](https://gvectors.com/product/comments-censure-pro/)

= Integration Add-ons =

* | [wpDiscuz - BuddyPress Integration](https://gvectors.com/product/wpdiscuz-buddypress-integration/)
* | [wpDiscuz - Tenor GIFs Integration](https://gvectors.com/product/wpdiscuz-tenor-integration/)
* | [wpDiscuz - GIPHY Integration](https://gvectors.com/product/wpdiscuz-giphy-integration/)
* | [wpDiscuz - Voice Commenting](https://gvectors.com/product/wpdiscuz-voice-commenting/)


== Installation ==

= Note =

IMPORTANT: If you have a Cache Plugin, please delete all caches after wpDiscuz update.

= Installation =

1. Upload plugin folder to the '/wp-content/plugins/' directory,
2. Activate the plugin through the 'Plugins' menu in WordPress.

After installing and activating the plugin, click on **Comments** menu item in the left sidebar in your website admin panel.

= Update to wpDiscuz 7 versions =

Please read the documentation:
[https://wpdiscuz.com/docs/wpdiscuz-7/plugin-installation/update-to-wpdiscuz-7/](https://wpdiscuz.com/docs/wpdiscuz-7/plugin-installation/update-to-wpdiscuz-7/)


== Frequently Asked Questions ==

**IMPORTANT**

* If you have a Cache Plugin, please delete all caches after wpDiscuz update.
* If wpDiscuz comment form is missing please read this support topic:
* <a target="_blank" href="https://wpdiscuz.com/docs/wpdiscuz-7/getting-started/missing-comment-form/">wpDiscuz comment form is missing</a>

= Comments - wpDiscuz Settings =

Basic configuration suits for most of cases, but if you want to configure **Comments - wpDiscuz** deeper, click on **» Settings** sub menu item which is under **wpDiscuz** menu item and change the settings as you want.

= Comments - wpDiscuz Phrases =

**Comments - wpDiscuz** has phrases for frontend, for those who want customize texts and messages without using .po/.mo files, but still you can use .po/.mo translation files with combination of **Comments - wpDiscuz** phrases. You just need to enable "Use Plugin .PO/.MO files" setting in **Comments - wpDiscuz** **» Settings** page

= Comments - wpDiscuz Documentation =

Here you can find more detailed answers for your questions - <a target="_blank" href="https://wpdiscuz.com/docs/">https://wpdiscuz.com/docs/</a>

= Support Forum =

For deeper support please visit our <a target="_blank" href="https://wpdiscuz.com/community/">**Support Forum**</a>

= Does this plugin fully replace the current comment system? =

Yes! **Comments - wpDiscuz** changes default comment system to a new interactive system.

= What will happen to old comments? =

Nothing will be lost!  **Comments - wpDiscuz** will show all old comments.

= Where comments are stored? =

**Comments - wpDiscuz** uses the default WordPress comment storage system, all comments are on your database and all comments are manageable in Dashboard > Comments admin page.

= Will my comments be lost if I install this plugin, and then remove it? =

**Comments - wpDiscuz** doesn't affect any data. You can install and uninstall whenever you want without any worries.


== Screenshots ==

1. wpDiscuz Comments Three Layouts | Screenshot #1
2. wpDiscuz Comments Form | Screenshot #2
3. wpDiscuz Comments View | Screenshot #3
4. wpDiscuz Comments on Mobile and Notebook | Screenshot #4
5. wpDiscuz Inline Comment Form | Screenshot #5
6. wpDiscuz Inline Comments | Screenshot #6
7. wpDiscuz Post Rating and Comment Rating | Screenshot #7
8. wpDiscuz Live Notification with Comment Bubble| Screenshot #8
9. wpDiscuz Social Login and Commenting| Screenshot #9
10. wpDiscuz Comment Statistic | Screenshot #10
11. wpDiscuz Settings | Screenshot #11
12. wpDiscuz Single Settings Page | Screenshot #12


== Changelog ==

**IMPORTANT!**

Please remember to delete all caches and purge CDN after the update.

= Comments - wpDiscuz v7.6.51-v7.6.54 - 10.04.2026 =

* Fixed: An issue with wpDiscuz nonce validation

= Comments - wpDiscuz v7.6.50 - 02.04.2026 =

* Fixed: An issue with wpDiscuz nonce validation
* Added: Load wpDiscuz comments for block themes automatically
* Added: Support for attachment preview replace (no need to re-upload all attachments anymore)

= Comments - wpDiscuz v7.6.49 - 26.03.2026 =

* Fixed: The images in the comments were displayed twice.

= Comments - wpDiscuz v7.6.48 - 21.03.2026 =

* Added: A new filter hook "wpdiscuz_show_vote" to allow hiding/showing vote buttons for certain comments.
* Added: A new filter hook "wpdiscuz_post_attachments_as_gallery" to allow controlling whether a post's attachments should be displayed as a gallery or not.
* Fixed: Prevent adding unnecessary statistics on comment deletion.
* Fixed: Guests can't vote on guest comments.
* Fixed: Issue with adding nonce in cookies that leads to an issue with nonce verification.

= Comments - wpDiscuz v7.6.47 - 11.03.2026 =

* Security: Unauth Email Notification Flood via wpdCheckNotificationType
* Security: Stored XSS in Inline Comment Preview
* Security: Shortcode Injection via Email Notifications
* Security: Stored XSS via Malicious Options Import
* Security: SQL Injection in getAllSubscriptions()
* Security: Vote Manipulation via Nonce Oracle and IP Rotation
* Security: IP Spoofing in getIP()
* Security: Destructive GET Action — Delete All Comments by Email
* Security: Options Export Leaks OAuth Secrets in Plaintext
* Security: Unsanitized Cookie Email Used as wp_mail() Recipient
* Security: XSS via Unescaped Custom CSS in <style> Tag
* Security: Unescaped Attachment URLs in HTML Output
* Security: Missing Nonce on wpdGetFollowsPage
* Security: No Rate Limiting on Subscription Endpoints + LIKE Wildcard Bypass


= Comments - wpDiscuz v7.6.46 - 09.02.2026 =

* Added: A new filter hook "wpdiscuz_is_update_nonce_with_ajax" to control nonce ajax requests for guests

= Comments - wpDiscuz v7.6.45 - 19.01.2026 =

* Added: A new filter hook "wpdiscuz_validate_nonce_for_guests" to control wpdGetNonce ajax requests for guest users

= Comments - wpDiscuz v7.6.44 - 15.01.2026 =

* Security: Fixed IDOR vulnerability in AJAX actions (CVE-2025-68997)
* Security: Added post access authorization check to voteOnComment - uses $comment->comment_post_ID from database, not user-supplied postId (prevents parameter manipulation bypass)
* Security: Added server-side rate limiting to AJAX actions (vote 20/min, rate 10/min, follow 15/min, subscribe 10/min)
* Security: Rate limiting on voteOnComment, userRate, followUser, addSubscription
* Security: Enhanced client fingerprinting (IP + User-Agent + Accept-Language)
* Security: Rate limiting executes before nonce validation for maximum protection
* Security: Object validation - verifies comment exists and is approved before processing
* Security: Post status validation - blocks access to private/password-protected posts for unauthorized users

= Comments - wpDiscuz v7.6.43 - 12.01.2026 =

* Fixed: Insecure Direct Object References (IDOR) vulnerability

= Comments - wpDiscuz v7.6.42 - 23.12.2025 =

* Fixed: An issue with inline commenting in Elementor

= Comments - wpDiscuz v7.6.41 - 22.12.2025 =

* Updated: Added gutenberg toolbar button for inline feedback shortcode generation

= Comments - wpDiscuz v7.6.40 - 09.12.2025 =

* Fixed: Disqus login vulnerability
