How do I check whether I am affected by CVE-2026-110384?

- Check the installed plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/fancy-facebook-comments/` - Run `wp plugin get fancy-facebook-comments --field=version` with WP-CLI

What is the fix for CVE-2026-110384?

- Update the Fancy Comments plugin to a version later than `1.2.21`, as the sources do not name a fixed release - If no fixed version is available, deactivate or remove the plugin

Who is not affected by CVE-2026-110384?

Not affected if: plugin-not-installed, plugin-updated.

Live › vulnerability › CVE-2026-110384

Go to dashboard

high7.1Package

WordPress Fancy Comments plugin: reflected XSS through 1.2.21

The Heateor Support Fancy Comments WordPress plugin does not neutralize input when generating a page, so a crafted link can inject script into the page. An attacker can run JavaScript in a visitor's browser, such as stealing session cookies or acting as the logged-in user.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

7.1

high

scored by [email protected]

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 17, 2026 UTC
Last modified: Oct 19, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Attacker runs script in visitors' browsers, stealing sessions.
CVSS said: 7.1. The facts above say medium; we keep the sources' high until an analyst looks.

Who is affected

Sites running the Fancy Comments WordPress plugin at version 1.2.21 or earlier are exposed. The issue is reflected, so a visitor must open a crafted link; sites without this plugin can skip it.

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-110384

Go to dashboard

high7.1Package

WordPress Fancy Comments plugin: reflected XSS through 1.2.21

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

7.1

high

scored by [email protected]

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 17, 2026 UTC
Last modified: Oct 19, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Attacker runs script in visitors' browsers, stealing sessions.
CVSS said: 7.1. The facts above say medium; we keep the sources' high until an analyst looks.

Who is affected

Sites running the Fancy Comments WordPress plugin at version 1.2.21 or earlier are exposed. The issue is reflected, so a visitor must open a crafted link; sites without this plugin can skip it.

Know the next one before it finds you.

Add to Slack

WordPress Fancy Comments plugin: reflected XSS through 1.2.21

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

WordPress Fancy Comments plugin: reflected XSS through 1.2.21

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources