Comments plugin stored Cross-site Scripting via a guest name

MEDIUM 5.4CVE-2020-13869 · GHSA-jhhf-c849-3rh2 · Published 05/06/2020 · updated 17/06/2026

In short

CVE-2020-13869 is a MEDIUM (CVSS 5.4) vulnerability affecting verbb/comments, comments (verbb).
Chance of exploitation in the next 30 days (EPSS): 0.54%, higher than 45.4% of all vulnerabilities.
Fix: update to 1.5.5 or later.

Package	Affected versions	Patched versions
verbb/comments Packagist	`< 1.5.5`	`1.5.5`
comments verbb	`< 1.5.5`	`1.5.5`

An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. There is stored XSS via a guest name.

NVD description

An issue was discovered in the Comments plugin before 1.5.6 for Craft CMS. There is stored XSS via a guest name.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.