WP-Safety

Better Comments Security & Risk Analysis

wordpress.org/plugins/better-comments

Transform WordPress comments into a beautiful, secure engagement system. Powerful customization without coding.

10 active installs v2.0.0 PHP 8.0+ WP 5.2+ Updated Jan 2, 2026
commentscustom-avatarperformancesecurityseo
99
A · Safe
CVEs total2
Unpatched0
Last CVEApr 3, 2024
Plugin page Download
Safety Verdict

Is Better Comments Safe to Use in 2026?

Generally Safe

Score 99/100

Better Comments has a strong security track record. Known vulnerabilities have been patched promptly. It's a solid choice for most WordPress installations.

2 known CVEsLast CVE: Apr 3, 2024Updated 4mo ago
Risk Assessment

The static analysis of 'better-comments' v2.0.0 shows a generally good security posture with no identified entry points like AJAX handlers, REST API routes, or shortcodes. The plugin demonstrates strong adherence to secure coding practices by exclusively using prepared statements for its SQL queries and properly escaping all 65 identified output points. Furthermore, the absence of file operations and external HTTP requests reduces the potential attack surface. The presence of a capability check, though only one, is a positive sign of privilege checking.

Key Concerns

  • Medium severity CVEs in history
  • Bundled outdated library (Freemius v1.0)
  • No nonce checks on potential entry points
Vulnerabilities
2 published

Better Comments Security Vulnerabilities

CVEs by Year

2 CVEs in 2024
2024
Patched Has unpatched

Severity Breakdown

Medium
2

2 total CVEs

CVE-2024-2404medium · 6.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Better Comments <= 1.5.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting

Apr 3, 2024 Patched in 1.5.6 (29d)
CVE-2024-2402medium · 4.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Better Comments <= 1.5.5 - Authenticated (Admin+) Stored Cross-Site Scripting

Apr 3, 2024 Patched in 1.5.6 (29d)
Version History

Better Comments Release Timeline

No version history available.
Code Analysis
Analyzed Mar 17, 2026

Better Comments Code Analysis

Dangerous Functions
0
Raw SQL Queries
0
2 prepared
Unescaped Output
0
65 escaped
Nonce Checks
0
Capability Checks
1
File Operations
0
External Requests
0
Bundled Libraries
1

Bundled Libraries

Freemius1.0

SQL Query Safety

100% prepared2 total queries

Output Escaping

100% escaped65 total outputs
Attack Surface

Better Comments Attack Surface

Entry Points0
Unprotected0
WordPress Hooks 26
actionafter_setup_themebetter-comments.php:102
actionplugins_loadedbetter-comments.php:115
actionplugins_loadedbetter-comments.php:136
filterplugin_row_metabetter-comments.php:157
filteradmin_footer_textbetter-comments.php:209
filtercomment_form_default_fieldsbetter-comments.php:226
actionwp_headbetter-comments.php:423
actioncarbon_fields_theme_options_container_savedbetter-comments.php:438
filtercomment_form_defaultsbetter-comments.php:474
filtercomment_form_fieldsbetter-comments.php:497
filteravatar_defaultsbetter-comments.php:523
filterget_avatarbetter-comments.php:644
actioncarbon_fields_theme_options_container_savedbetter-comments.php:686
actionadmin_enqueue_scriptsbetter-comments.php:774
actioncarbon_fields_register_fieldsincludes\options.php:85
filtersky_bco_options_tabsincludes\options.php:109
filtersky_bco_options_fields_tab_formincludes\options.php:334
filtersky_bco_options_fields_tab_designincludes\options.php:466
filtersky_bco_options_fields_tab_tweaksincludes\options.php:598
filtersky_bco_options_fields_tab_quicktagsincludes\options.php:768
filtersky_bco_options_fields_tab_seoincludes\options.php:819
filtersky_bco_options_fields_tab_pluginsincludes\options.php:841
filtersky_bco_options_fields_tab_disableincludes\options.php:930
actioncarbon_fields_register_fieldsincludes\options.php:939
filteruser_profile_picture_descriptionincludes\options.php:952
actioncarbon_fields_container_better_comments_after_sidebarincludes\options.php:1022
Maintenance & Trust

Better Comments Maintenance & Trust

Maintenance Signals

WordPress version tested6.9.4
Last updatedJan 2, 2026
PHP min version8.0
Downloads3K

Community Trust

Rating70/100
Number of ratings2
Active installs10
Alternatives

Better Comments Alternatives

Staatic – Static Site Generator

Staatic – Static Site Generator

staatic

A
100

Staatic lets you create and deploy a streamlined static version of your WordPress site.

2K No CVEs
App for Cloudflare®

App for Cloudflare®

app-for-cf

A
100

All things Cloudflare (caching, flexible SSL, Turnstile, settings, rules, analytics, media in R2, image transforms [AVIF, WebP], secure admin area).

1K No CVEs
WPControl – The Easiest Optimization Plugin for WordPress

WPControl – The Easiest Optimization Plugin for WordPress

wpcontrol

A
85

The easiest way to improve your website's security, performance, and user experience.

200 No CVEs
Static Snap

Static Snap

static-snap

A
100

Static Snap converts your WordPress site into a static website, boosting performance, security, scalability, and SEO.

30 No CVEs
Essential WP Tools – Customize WP Features, Security, SEO, Speed, Share Buttons, Ad, Maintenance & much more

Essential WP Tools – Customize WP Features, Security, SEO, Speed, Share Buttons, Ad, Maintenance & much more

essential-wp-tools

A
92

Essential WP Tools is an all-in-one solution for customizing features, optimizing speed, boosting security, improving SEO, and enhancing WordPress.

10 No CVEs
Developer Profile

Better Comments Developer Profile

Matt Biscay

5 plugins · 2K total installs

94
trust score
Avg Security Score
100/100
Avg Patch Time
29 days
View full developer profile
Detection Fingerprints

How We Detect Better Comments

Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.

Asset Fingerprints

Asset Paths
/wp-content/plugins/better-comments/assets/css/admin.css/wp-content/plugins/better-comments/assets/js/backend.js
Script Paths
/wp-content/plugins/better-comments/assets/js/backend.js
Version Parameters
better-comments/assets/css/admin.css?ver=better-comments/assets/js/backend.js?ver=

HTML / DOM Fingerprints

CSS Classes
better-comments-admin-page
HTML Comments
<!-- Better Comments Settings -->
Data Attributes
data-bc-settings
JS Globals
window.betterCommentsAdmin
FAQ

Frequently Asked Questions about Better Comments