{
    "title": "wpDiscuz",
    "seo_title": "wpDiscuz: review, recommended settings and limits",
    "h1": "wpDiscuz",
    "description": "wpDiscuz: who this comment system suits, its limits (past vulnerabilities, paid add-ons), the settings we recommend and the fixes to apply.",
    "lead": "wpDiscuz replaces your theme’s comments with an AJAX system featuring voting, subscriptions and social login, while keeping comments inside WordPress. This sheet covers who it suits, its limitations, the settings to tighten and its patched vulnerabilities.",
    "language": "en",
    "locale": "en-US",
    "type": "plugin-sheet",
    "url": "https://www.wp-masquerade.com/features/camouflaged-plugins/wpdiscuz/",
    "canonical": "https://www.wp-masquerade.com/features/camouflaged-plugins/wpdiscuz/",
    "markdown": "https://www.wp-masquerade.com/features/camouflaged-plugins/wpdiscuz/index.md",
    "json": "https://www.wp-masquerade.com/features/camouflaged-plugins/wpdiscuz/index.json",
    "published": "2026-11-05T08:00:00+00:00",
    "modified": "2026-11-05T21:33:52+00:00",
    "site": {
        "name": "WP Masquerade",
        "url": "https://www.wp-masquerade.com/"
    },
    "translations": [
        {
            "language": "en",
            "hreflang": "en-US",
            "title": "wpDiscuz",
            "url": "https://www.wp-masquerade.com/features/camouflaged-plugins/wpdiscuz/",
            "markdown": "https://www.wp-masquerade.com/features/camouflaged-plugins/wpdiscuz/index.md",
            "json": "https://www.wp-masquerade.com/features/camouflaged-plugins/wpdiscuz/index.json"
        },
        {
            "language": "fr",
            "hreflang": "fr-FR",
            "title": "wpDiscuz",
            "url": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/wpdiscuz/",
            "markdown": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/wpdiscuz/index.md",
            "json": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/wpdiscuz/index.json"
        },
        {
            "language": "es",
            "hreflang": "es-ES",
            "title": "wpDiscuz",
            "url": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/wpdiscuz/",
            "markdown": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/wpdiscuz/index.md",
            "json": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/wpdiscuz/index.json"
        },
        {
            "language": "de",
            "hreflang": "de-DE",
            "title": "wpDiscuz",
            "url": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/wpdiscuz/",
            "markdown": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/wpdiscuz/index.md",
            "json": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/wpdiscuz/index.json"
        },
        {
            "language": "it",
            "hreflang": "it-IT",
            "title": "wpDiscuz",
            "url": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/wpdiscuz/",
            "markdown": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/wpdiscuz/index.md",
            "json": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/wpdiscuz/index.json"
        },
        {
            "language": "pt",
            "hreflang": "pt-BR",
            "title": "wpDiscuz",
            "url": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/wpdiscuz/",
            "markdown": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/wpdiscuz/index.md",
            "json": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/wpdiscuz/index.json"
        },
        {
            "language": "nl",
            "hreflang": "nl-NL",
            "title": "wpDiscuz",
            "url": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/wpdiscuz/",
            "markdown": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/wpdiscuz/index.md",
            "json": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/wpdiscuz/index.json"
        }
    ],
    "headings": [
        {
            "level": 1,
            "text": "wpDiscuz"
        },
        {
            "level": 2,
            "text": "What wpDiscuz does under your posts"
        },
        {
            "level": 2,
            "text": "Which sites wpDiscuz is a good fit for"
        },
        {
            "level": 2,
            "text": "wpDiscuz strengths and limitations"
        },
        {
            "level": 3,
            "text": "Strengths"
        },
        {
            "level": 3,
            "text": "Limitations"
        },
        {
            "level": 2,
            "text": "The wpDiscuz settings we recommend"
        },
        {
            "level": 2,
            "text": "wpDiscuz’s patched vulnerabilities"
        },
        {
            "level": 2,
            "text": "wpDiscuz FAQ",
            "id": "faq"
        }
    ],
    "body": "## The essentials\n\n- Best for blogs and magazines with long discussions that want to keep their comments inside WordPress.\n- Main caveat: a record of serious vulnerabilities, mostly in file uploads and social login.\n- Free; paid add-ons, including a bundle of 17 add-ons for $120 covering unlimited sites.\n\n## What wpDiscuz does under your posts\n\nwpDiscuz replaces your theme’s comment section with its own system: the form, multi-level threads, sorting by date or by votes, and AJAX posting and loading without a page reload. The comments themselves are still WordPress comments, stored in the native database table: nothing is handed to an external service like Disqus, and your existing comments show up as they are the moment you activate it.\n\nThe free plugin adds voting, post ratings, inline comments on a passage of text, reply subscriptions, mentions, custom comment forms, social login, image uploads, live updates and Google reCAPTCHA v2, plus a block for the editor. Anything the native system has no place for (subscriptions, votes, follows, phrases) goes into its own database tables.\n\nwpDiscuz is developed by gVectors, which sells add-ons on its own site: advanced WooCommerce reviews (the Reviews add-on), invisible reCAPTCHA v3, front-end moderation, private comments, comment search, reporting, ads and more. The bundle of the 17 most used add-ons costs $120 for unlimited sites, with one year of support and updates; the Reviews add-on alone starts at $49 for one site.\n\n![Diagram: wpDiscuz works on visitors and bots, wordpress, database and files. Public traces: signed HTML comments (hidden with Pro); folder name (hidden with Pro); tag IDs (hidden with Pro); generated-file folders (hidden with Pro); tag IDs (still visible); JavaScript variables (still visible); CSS classes (still visible).](https://www.wp-masquerade.com/media/wpm-sheets/wpdiscuz/diagram-en.svg?v=20a759a7)\n\n## Which sites wpDiscuz is a good fit for\n\n- **Blogs and magazines** with long discussions that want readable threads, voting and sorting by popularity.\n- **Sites moving off Disqus or Jetpack Comments** that want to keep their comments in their own database.\n- **Communities and membership sites** that want reply subscriptions, mentions and social login.\n- **Editorial sites collecting feedback** on a specific passage through inline comments.\n\nIt is the wrong choice if your posts get few comments: the native form, backed by an anti-spam plugin, is enough and loads less code. Skip it too if you cannot keep up with frequent updates.\n\n## wpDiscuz strengths and limitations\n\n### Strengths\n\n- **Native comments.** They stay in the WordPress database and survive removing the plugin.\n- **A very complete free version.** Voting, inline comments, subscriptions, custom forms and social login are included without any paid add-on.\n- **Translated interface.** The admin screens and front-end text are translated into many languages, and the Phrases screen lets you rewrite them.\n- **Documented fixes.** The changelog and the developer’s security file describe each patched vulnerability and what to do about it.\n\n### Limitations\n\n- **A heavy vulnerability record.** Several serious flaws hit file uploads and social login, both reachable without an account.\n- **Advanced features cost extra.** Advanced WooCommerce reviews, reCAPTCHA v3 and front-end moderation need add-ons on a yearly license.\n- **More code for visitors.** The plugin loads its own scripts and styles, and live updates poll the server at a set interval.\n- **wpDiscuz-only data.** Votes, subscriptions and follows live outside the native system, so you lose them if you switch plugins.\n\n## The wpDiscuz settings we recommend\n\nOut of the box, wpDiscuz lets guests attach images and leaves reCAPTCHA off. These settings narrow down what an anonymous visitor can do.\n\n| Setting | Recommended value | Why |\n| --- | --- | --- |\n| **Allow Media Uploading for Guests**  wpDiscuz > Settings > Comment Content and Media | Off, unless anonymous readers really need to attach images | On by default; file uploads without an account are the plugin’s most exposed feature. |\n| **Allowed File Types** and **Max Uploaded Size**  Same section | Only jpg, jpeg, png and gif; default size (2 MB) or less | Fewer accepted formats, fewer surprises in the upload folder. |\n| **Enable for Guests**  wpDiscuz > Settings > Google reCAPTCHA | On, after entering the Site Key and Secret Key of a reCAPTCHA v2 key | Off by default; it stops a good share of bots that post in bulk. |\n| **Social login buttons**  wpDiscuz > Settings > Social Login and Share | Only the networks your readers use; keep “User agreement prior to a social login action” on | Several serious flaws came from login providers; every unused button is one more door. |\n| **Enable WordPress Shortcodes in Comment Content**  wpDiscuz > Settings > Comment Content and Media | Off (default) | Visitors have no reason to trigger your plugins’ shortcodes, and some of them slow the page down. |\n| **Enable Live Update for Guests**  wpDiscuz > Settings > Live Commenting and Notifications | Off (default) on shared hosting; otherwise an interval of 60 seconds or more | Every open page queries the server at each interval. |\n| **Enable Cache**  wpDiscuz > Settings > General Settings | On (default), with version 7.6.75 or later | The comment cache is encrypted since that version; before, it could be read on some servers. |\n| **Updates**  Plugins > Installed Plugins | Auto-updates on, then page cache and CDN purged, as the developer asks | Security fixes keep coming; the developer only supports the latest version. |\n\n- After updating to 7.6.75, open a page of your site that is not served from cache so wpDiscuz can move its old cache, and check that WordPress scheduled tasks are running.\n- Post a test comment in a private window and check that reCAPTCHA shows up.\n- In General Settings, leave “Help wpDiscuz to grow…” unchecked; it adds a mention of the plugin below the comments.\n- Pair the plugin with an anti-spam filter such as [Akismet](https://www.wp-masquerade.com/features/camouflaged-plugins/akismet/) (our [WordPress anti-spam](https://www.wp-masquerade.com/wordpress-anti-spam/) page compares the approaches).\n\n## wpDiscuz’s patched vulnerabilities\n\nThe best known is CVE-2020-24186 (CVSS 10): in versions 7.0 through 7.0.4, a visitor without an account could upload a PHP file through the image upload feature and run code on the server ([remote code execution](https://www.wp-masquerade.com/glossary/remote-code-execution/)). Version 7.0.5 fixed it. More recently, two social login flaws let an attacker sign in to another user’s account, administrators included, by knowing the email address: CVE-2024-9488 (CVSS 9.8, WordPress.com provider, versions up to 7.6.24) and CVE-2025-13820 (Disqus provider, fixed in 7.6.40).\n\nCVE-2026-119366 (CVSS 7.1), a stored [XSS vulnerability](https://www.wp-masquerade.com/glossary/xss/) through a commenter’s name, affects versions up to 7.6.73 and is fixed in 7.6.74. Version 7.6.75 fixes an issue the developer rates as high severity: on servers that ignore `.htaccess` files, such as Nginx, the comment cache files could be read directly and held email addresses, IP addresses and account data.\n\nWhat helps: automatic plugin updates, few social login providers, and no guest file uploads without a reason. WP Masquerade Pro removes the signed HTML comments and hides the `wpdiscuz` folder name in file addresses and in the IDs of its style and script tags, including `uploads/wpdiscuz`; the `#wpdcom` ID, the JavaScript variables and the `wpd-*` classes stay visible, and the free version does not hide wpDiscuz. This camouflage makes the plugin harder for bots to spot, without replacing the update.\n\n## wpDiscuz FAQ\n\n**Will my existing comments be kept when I install wpDiscuz?**\n\nYes. wpDiscuz displays the comments already in the WordPress database, with no import, since it uses the native comment system.\n\n**What happens if I remove wpDiscuz?**\n\nSimply deactivating it changes nothing. The “Uninstall” link in the plugin list, however, deletes all wpDiscuz-specific data (subscriptions, attachments, votes); the comments themselves stay. Back up your database first.\n\n**Does wpDiscuz protect against spam?**\n\nIt relies on WordPress moderation and offers Google reCAPTCHA v2 for guests. To filter spam written by hand, add a service such as Akismet, which wpDiscuz works with.\n\n**Do I need to buy add-ons to use it?**\n\nNo, the plugin is complete without them. Paid add-ons bring specific features, such as advanced WooCommerce reviews or reCAPTCHA v3, and their yearly license covers updates and support.\n\n## Key facts\n\n- Category: Utilities\n- Vendor: gVectors\n- Price: Free; paid add-ons, including a bundle of 17 add-ons for $120 for unlimited sites (one year of support and updates)\n- Active installations (wordpress.org): 60 000+\n- Version: 7.6.75\n- Official page: https://wordpress.org/plugins/wpdiscuz/\n\n## What WP Masquerade hides\n\n- Handled by WP Masquerade Pro only\n- With Pro: signed HTML comments, folder name, tag IDs, generated-file folders\n- Still visible: tag IDs, JavaScript variables, CSS classes",
    "catalog": "wpdiscuz",
    "essentials": [
        "Best for blogs and magazines with long discussions that want to keep their comments inside WordPress.",
        "Main caveat: a record of serious vulnerabilities, mostly in file uploads and social login.",
        "Free; paid add-ons, including a bundle of 17 add-ons for $120 covering unlimited sites."
    ],
    "format": "application/json"
}