CVE-2026-110384: WordPress Fancy Comments WordPress plugin <= 1.2.21 - Cross Site Scripting (XSS) vulnerability

Q: What does an attacker need to exploit this issue?

The vector is network-accessible, requires no privileges, and has low attack complexity. Exploitation requires user interaction, consistent with a reflected XSS attack.

Q: What impact could successful exploitation have?

The reported impact includes low confidentiality, integrity, and availability effects, with scope changed. A successful attack could execute attacker-controlled script in a user's browser in the context affected by the plugin.

Q: Which plugin versions are affected?

Fancy Comments WordPress versions through 1.2.21 are affected. The available data does not identify a fixed version.

Published Oct 17, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Heateor Support Fancy Comments WordPress fancy-facebook-comments allows Reflected XSS.This issue affects Fancy Comments WordPress: from n/a through 1.2.21.

Affected Software

1 affected component

Heateor Support Fancy Comments WordPress<=1.2.21

Event History

Oct 17, 2026

CVE Published

via MITRE·07:00 AM

Data Sourced

via MITRE·07:00 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

The vector is network-accessible, requires no privileges, and has low attack complexity. Exploitation requires user interaction, consistent with a reflected XSS attack.

What impact could successful exploitation have?

The reported impact includes low confidentiality, integrity, and availability effects, with scope changed. A successful attack could execute attacker-controlled script in a user's browser in the context affected by the plugin.

Which plugin versions are affected?