Read the docs
TI-2013-01230 Aliases CVE-2013-1409GHSA-gp94-5mjf-fgw9

Cross-site scripting (XSS) vulnerability in the CommentLuv plugin before 2.92.4 for…

Priority LOW 27CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · Partial · None
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

Cross-site scripting (XSS) vulnerability in the CommentLuv plugin before 2.92.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the _ajax_nonce parameter to wp-admin/admin-ajax.php.

Why it matters now

EPSS 0.04529 91st percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 53

CPEVersionsRoleVendor
cpe:2.3:a:commentluv:commentluv:*:*:*:*:*:wordpress:*:*up to 2.92.3VulnerableCommentluv
cpe:2.3:a:commentluv:commentluv:2.7:*:*:*:*:wordpress:*:*2.7VulnerableCommentluv
cpe:2.3:a:commentluv:commentluv:2.71:*:*:*:*:wordpress:*:*2.71VulnerableCommentluv
cpe:2.3:a:commentluv:commentluv:2.74:*:*:*:*:wordpress:*:*2.74VulnerableCommentluv
cpe:2.3:a:commentluv:commentluv:2.76:*:*:*:*:wordpress:*:*2.76VulnerableCommentluv
cpe:2.3:a:commentluv:commentluv:2.80:*:*:*:*:wordpress:*:*2.80VulnerableCommentluv
cpe:2.3:a:commentluv:commentluv:2.81:*:*:*:*:wordpress:*:*2.81VulnerableCommentluv
cpe:2.3:a:commentluv:commentluv:2.81.1:*:*:*:*:wordpress:*:*2.81.1VulnerableCommentluv
cpe:2.3:a:commentluv:commentluv:2.81.2:*:*:*:*:wordpress:*:*2.81.2VulnerableCommentluv
cpe:2.3:a:commentluv:commentluv:2.81.3:*:*:*:*:wordpress:*:*2.81.3VulnerableCommentluv
  • cpe:2.3:a:commentluv:commentluv:*:*:*:*:*:wordpress:*:* Versions up to 2.92.3 Vulnerable ·Commentluv
  • cpe:2.3:a:commentluv:commentluv:2.7:*:*:*:*:wordpress:*:* Versions 2.7 Vulnerable ·Commentluv
  • cpe:2.3:a:commentluv:commentluv:2.71:*:*:*:*:wordpress:*:* Versions 2.71 Vulnerable ·Commentluv
  • cpe:2.3:a:commentluv:commentluv:2.74:*:*:*:*:wordpress:*:* Versions 2.74 Vulnerable ·Commentluv
  • cpe:2.3:a:commentluv:commentluv:2.76:*:*:*:*:wordpress:*:* Versions 2.76 Vulnerable ·Commentluv
  • cpe:2.3:a:commentluv:commentluv:2.80:*:*:*:*:wordpress:*:* Versions 2.80 Vulnerable ·Commentluv
  • cpe:2.3:a:commentluv:commentluv:2.81:*:*:*:*:wordpress:*:* Versions 2.81 Vulnerable ·Commentluv
  • cpe:2.3:a:commentluv:commentluv:2.81.1:*:*:*:*:wordpress:*:* Versions 2.81.1 Vulnerable ·Commentluv
  • cpe:2.3:a:commentluv:commentluv:2.81.2:*:*:*:*:wordpress:*:* Versions 2.81.2 Vulnerable ·Commentluv
  • cpe:2.3:a:commentluv:commentluv:2.81.3:*:*:*:*:wordpress:*:* Versions 2.81.3 Vulnerable ·Commentluv
Show 43 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:commentluv:commentluv:2.81.4:*:*:*:*:wordpress:*:*2.81.4VulnerableCommentluv
cpe:2.3:a:commentluv:commentluv:2.81.5:*:*:*:*:wordpress:*:*2.81.5VulnerableCommentluv
cpe:2.3:a:commentluv:commentluv:2.81.6:*:*:*:*:wordpress:*:*2.81.6VulnerableCommentluv
cpe:2.3:a:commentluv:commentluv:2.81.7:*:*:*:*:wordpress:*:*2.81.7VulnerableCommentluv
cpe:2.3:a:commentluv:commentluv:2.81.8:*:*:*:*:wordpress:*:*2.81.8VulnerableCommentluv
cpe:2.3:a:commentluv:commentluv:2.90.1:*:*:*:*:wordpress:*:*2.90.1VulnerableCommentluv
cpe:2.3:a:commentluv:commentluv:2.90.3:*:*:*:*:wordpress:*:*2.90.3VulnerableCommentluv
cpe:2.3:a:commentluv:commentluv:2.90.5:*:*:*:*:wordpress:*:*2.90.5VulnerableCommentluv
cpe:2.3:a:commentluv:commentluv:2.90.6:*:*:*:*:wordpress:*:*2.90.6VulnerableCommentluv
cpe:2.3:a:commentluv:commentluv:2.90.7:*:*:*:*:wordpress:*:*2.90.7VulnerableCommentluv
cpe:2.3:a:commentluv:commentluv:2.90.8:*:*:*:*:wordpress:*:*2.90.8VulnerableCommentluv
cpe:2.3:a:commentluv:commentluv:2.90.8.1:*:*:*:*:wordpress:*:*2.90.8.1VulnerableCommentluv
cpe:2.3:a:commentluv:commentluv:2.90.8.2:*:*:*:*:wordpress:*:*2.90.8.2VulnerableCommentluv
cpe:2.3:a:commentluv:commentluv:2.90.8.3:*:*:*:*:wordpress:*:*2.90.8.3VulnerableCommentluv
cpe:2.3:a:commentluv:commentluv:2.90.9:*:*:*:*:wordpress:*:*2.90.9VulnerableCommentluv
cpe:2.3:a:commentluv:commentluv:2.90.9.1:*:*:*:*:wordpress:*:*2.90.9.1VulnerableCommentluv
cpe:2.3:a:commentluv:commentluv:2.90.9.2:*:*:*:*:wordpress:*:*2.90.9.2VulnerableCommentluv
cpe:2.3:a:commentluv:commentluv:2.90.9.3:*:*:*:*:wordpress:*:*2.90.9.3VulnerableCommentluv
cpe:2.3:a:commentluv:commentluv:2.90.9.4:*:*:*:*:wordpress:*:*2.90.9.4VulnerableCommentluv
cpe:2.3:a:commentluv:commentluv:2.90.9.5:*:*:*:*:wordpress:*:*2.90.9.5VulnerableCommentluv
cpe:2.3:a:commentluv:commentluv:2.90.9.6:*:*:*:*:wordpress:*:*2.90.9.6VulnerableCommentluv
cpe:2.3:a:commentluv:commentluv:2.90.9.7:*:*:*:*:wordpress:*:*2.90.9.7VulnerableCommentluv
cpe:2.3:a:commentluv:commentluv:2.90.9.8:*:*:*:*:wordpress:*:*2.90.9.8VulnerableCommentluv
cpe:2.3:a:commentluv:commentluv:2.90.9.9:*:*:*:*:wordpress:*:*2.90.9.9VulnerableCommentluv
cpe:2.3:a:commentluv:commentluv:2.90.9.9.1:*:*:*:*:wordpress:*:*2.90.9.9.1VulnerableCommentluv
cpe:2.3:a:commentluv:commentluv:2.90.9.9.2:*:*:*:*:wordpress:*:*2.90.9.9.2VulnerableCommentluv
cpe:2.3:a:commentluv:commentluv:2.90.9.9.3:*:*:*:*:wordpress:*:*2.90.9.9.3VulnerableCommentluv
cpe:2.3:a:commentluv:commentluv:2.91:*:*:*:*:wordpress:*:*2.91VulnerableCommentluv
cpe:2.3:a:commentluv:commentluv:2.91.1:*:*:*:*:wordpress:*:*2.91.1VulnerableCommentluv
cpe:2.3:a:commentluv:commentluv:2.92:*:*:*:*:wordpress:*:*2.92VulnerableCommentluv
cpe:2.3:a:commentluv:commentluv:2.92.1:*:*:*:*:wordpress:*:*2.92.1VulnerableCommentluv
cpe:2.3:a:commentluv:commentluv:2.92.2:*:*:*:*:wordpress:*:*2.92.2VulnerableCommentluv
cpe:2.3:a:commentluv:commentluv:2.761:*:*:*:*:wordpress:*:*2.761VulnerableCommentluv
cpe:2.3:a:commentluv:commentluv:2.762:*:*:*:*:wordpress:*:*2.762VulnerableCommentluv
cpe:2.3:a:commentluv:commentluv:2.763:*:*:*:*:wordpress:*:*2.763VulnerableCommentluv
cpe:2.3:a:commentluv:commentluv:2.764:*:*:*:*:wordpress:*:*2.764VulnerableCommentluv
cpe:2.3:a:commentluv:commentluv:2.765:*:*:*:*:wordpress:*:*2.765VulnerableCommentluv
cpe:2.3:a:commentluv:commentluv:2.766:*:*:*:*:wordpress:*:*2.766VulnerableCommentluv
cpe:2.3:a:commentluv:commentluv:2.767:*:*:*:*:wordpress:*:*2.767VulnerableCommentluv
cpe:2.3:a:commentluv:commentluv:2.768:*:*:*:*:wordpress:*:*2.768VulnerableCommentluv
cpe:2.3:a:commentluv:commentluv:2.769:*:*:*:*:wordpress:*:*2.769VulnerableCommentluv
cpe:2.3:a:commentluv:commentluv:2.7691:*:*:*:*:wordpress:*:*2.7691VulnerableCommentluv
cpe:2.3:a:wordpress:wordpress:-:*:*:*:*:*:*:*not specified by NVDRunning onWordPress
  • cpe:2.3:a:commentluv:commentluv:2.81.4:*:*:*:*:wordpress:*:* Versions 2.81.4 Vulnerable ·Commentluv
  • cpe:2.3:a:commentluv:commentluv:2.81.5:*:*:*:*:wordpress:*:* Versions 2.81.5 Vulnerable ·Commentluv
  • cpe:2.3:a:commentluv:commentluv:2.81.6:*:*:*:*:wordpress:*:* Versions 2.81.6 Vulnerable ·Commentluv
  • cpe:2.3:a:commentluv:commentluv:2.81.7:*:*:*:*:wordpress:*:* Versions 2.81.7 Vulnerable ·Commentluv
  • cpe:2.3:a:commentluv:commentluv:2.81.8:*:*:*:*:wordpress:*:* Versions 2.81.8 Vulnerable ·Commentluv
  • cpe:2.3:a:commentluv:commentluv:2.90.1:*:*:*:*:wordpress:*:* Versions 2.90.1 Vulnerable ·Commentluv
  • cpe:2.3:a:commentluv:commentluv:2.90.3:*:*:*:*:wordpress:*:* Versions 2.90.3 Vulnerable ·Commentluv
  • cpe:2.3:a:commentluv:commentluv:2.90.5:*:*:*:*:wordpress:*:* Versions 2.90.5 Vulnerable ·Commentluv
  • cpe:2.3:a:commentluv:commentluv:2.90.6:*:*:*:*:wordpress:*:* Versions 2.90.6 Vulnerable ·Commentluv
  • cpe:2.3:a:commentluv:commentluv:2.90.7:*:*:*:*:wordpress:*:* Versions 2.90.7 Vulnerable ·Commentluv
  • cpe:2.3:a:commentluv:commentluv:2.90.8:*:*:*:*:wordpress:*:* Versions 2.90.8 Vulnerable ·Commentluv
  • cpe:2.3:a:commentluv:commentluv:2.90.8.1:*:*:*:*:wordpress:*:* Versions 2.90.8.1 Vulnerable ·Commentluv
  • cpe:2.3:a:commentluv:commentluv:2.90.8.2:*:*:*:*:wordpress:*:* Versions 2.90.8.2 Vulnerable ·Commentluv
  • cpe:2.3:a:commentluv:commentluv:2.90.8.3:*:*:*:*:wordpress:*:* Versions 2.90.8.3 Vulnerable ·Commentluv
  • cpe:2.3:a:commentluv:commentluv:2.90.9:*:*:*:*:wordpress:*:* Versions 2.90.9 Vulnerable ·Commentluv
  • cpe:2.3:a:commentluv:commentluv:2.90.9.1:*:*:*:*:wordpress:*:* Versions 2.90.9.1 Vulnerable ·Commentluv
  • cpe:2.3:a:commentluv:commentluv:2.90.9.2:*:*:*:*:wordpress:*:* Versions 2.90.9.2 Vulnerable ·Commentluv
  • cpe:2.3:a:commentluv:commentluv:2.90.9.3:*:*:*:*:wordpress:*:* Versions 2.90.9.3 Vulnerable ·Commentluv
  • cpe:2.3:a:commentluv:commentluv:2.90.9.4:*:*:*:*:wordpress:*:* Versions 2.90.9.4 Vulnerable ·Commentluv
  • cpe:2.3:a:commentluv:commentluv:2.90.9.5:*:*:*:*:wordpress:*:* Versions 2.90.9.5 Vulnerable ·Commentluv
  • cpe:2.3:a:commentluv:commentluv:2.90.9.6:*:*:*:*:wordpress:*:* Versions 2.90.9.6 Vulnerable ·Commentluv
  • cpe:2.3:a:commentluv:commentluv:2.90.9.7:*:*:*:*:wordpress:*:* Versions 2.90.9.7 Vulnerable ·Commentluv
  • cpe:2.3:a:commentluv:commentluv:2.90.9.8:*:*:*:*:wordpress:*:* Versions 2.90.9.8 Vulnerable ·Commentluv
  • cpe:2.3:a:commentluv:commentluv:2.90.9.9:*:*:*:*:wordpress:*:* Versions 2.90.9.9 Vulnerable ·Commentluv
  • cpe:2.3:a:commentluv:commentluv:2.90.9.9.1:*:*:*:*:wordpress:*:* Versions 2.90.9.9.1 Vulnerable ·Commentluv
  • cpe:2.3:a:commentluv:commentluv:2.90.9.9.2:*:*:*:*:wordpress:*:* Versions 2.90.9.9.2 Vulnerable ·Commentluv
  • cpe:2.3:a:commentluv:commentluv:2.90.9.9.3:*:*:*:*:wordpress:*:* Versions 2.90.9.9.3 Vulnerable ·Commentluv
  • cpe:2.3:a:commentluv:commentluv:2.91:*:*:*:*:wordpress:*:* Versions 2.91 Vulnerable ·Commentluv
  • cpe:2.3:a:commentluv:commentluv:2.91.1:*:*:*:*:wordpress:*:* Versions 2.91.1 Vulnerable ·Commentluv
  • cpe:2.3:a:commentluv:commentluv:2.92:*:*:*:*:wordpress:*:* Versions 2.92 Vulnerable ·Commentluv
  • cpe:2.3:a:commentluv:commentluv:2.92.1:*:*:*:*:wordpress:*:* Versions 2.92.1 Vulnerable ·Commentluv
  • cpe:2.3:a:commentluv:commentluv:2.92.2:*:*:*:*:wordpress:*:* Versions 2.92.2 Vulnerable ·Commentluv
  • cpe:2.3:a:commentluv:commentluv:2.761:*:*:*:*:wordpress:*:* Versions 2.761 Vulnerable ·Commentluv
  • cpe:2.3:a:commentluv:commentluv:2.762:*:*:*:*:wordpress:*:* Versions 2.762 Vulnerable ·Commentluv
  • cpe:2.3:a:commentluv:commentluv:2.763:*:*:*:*:wordpress:*:* Versions 2.763 Vulnerable ·Commentluv
  • cpe:2.3:a:commentluv:commentluv:2.764:*:*:*:*:wordpress:*:* Versions 2.764 Vulnerable ·Commentluv
  • cpe:2.3:a:commentluv:commentluv:2.765:*:*:*:*:wordpress:*:* Versions 2.765 Vulnerable ·Commentluv
  • cpe:2.3:a:commentluv:commentluv:2.766:*:*:*:*:wordpress:*:* Versions 2.766 Vulnerable ·Commentluv
  • cpe:2.3:a:commentluv:commentluv:2.767:*:*:*:*:wordpress:*:* Versions 2.767 Vulnerable ·Commentluv
  • cpe:2.3:a:commentluv:commentluv:2.768:*:*:*:*:wordpress:*:* Versions 2.768 Vulnerable ·Commentluv
  • cpe:2.3:a:commentluv:commentluv:2.769:*:*:*:*:wordpress:*:* Versions 2.769 Vulnerable ·Commentluv
  • cpe:2.3:a:commentluv:commentluv:2.7691:*:*:*:*:wordpress:*:* Versions 2.7691 Vulnerable ·Commentluv
  • cpe:2.3:a:wordpress:wordpress:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WordPress

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2013-1409
  2. 2026-10-03 Alias added: GHSA-gp94-5mjf-fgw9

References

Exploit 3

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences