Medium · 4.8 CVE-2021-36911 EUVD-2021-23487GHSA-rx4w-62p5-v393

WordPress Comment Engine Pro plugin <= 1.0 - Stored Cross-Site Scripting (XSS) vulnerability

Published Dec 10, 2021 · Updated Apr 28, 2026 · Assigned by Patchstack

Vendor: @rex1989 Product: Comment Engine Pro (WordPress plugin) Category: Web / CMS

Description

Stored Cross-Site Scripting (XSS) vulnerability discovered in WordPress Comment Engine Pro plugin (versions <= 1.0), could be exploited by users with Editor or higher role.

Affected products

Vendor	Product	Affected	Fixed
@rex1989	Comment Engine Pro (WordPress plugin)	<= 1.0 – ≤ 1.0	—

References

https://wordpress.org/plugins/comment-engine-pro/
https://patchstack.com/database/vulnerability/comment-engine-pro/wordpress-comment-engine-pro-plugin-1-0-stored-cross-site-scripting-xss-vulnerability