Comments – wpDiscuz

Changelog

IMPORTANT!

Please remember to delete all caches and purge CDN after the update.

Comments – wpDiscuz v7.6.71 – 16.09.2026

• Fixed: The comment bubble and the live comment update never showed comments posted without an email address to visitors who have no email address themselves, visitors who have not commented yet and guests who comment anonymously. A visitor’s own new comments are left out of these updates by their email address, and an empty address matched every comment posted without one, so anonymous commenters were hidden from each other and from everyone who has not commented. The email address is now only used when the visitor has one, a guest commenting anonymously keeps their own comments out of the update through the ones already on their screen.
• Fixed: The new comment message of the comment bubble described the newest comment of the post, even when the bubble was not notifying about that comment, the visitor’s own comment or one already on their screen. It now describes the newest comment the visitor is being notified about, and is left out of the response when that comment cannot be read, a private comment an addon keeps from the visitor for instance, where it used to be built from nothing.
• Fixed: The Cookies Consent and Agreement checkbox labels were printed on the comment form, and on the comment edit form, without being escaped. The labels are cleaned when the form is saved, but that only applies to what is saved from then on, so a label stored before v7.6.13 kept whatever markup it was given and was still printed as markup to every visitor. The labels are now filtered where they are printed, the agreement label by the same rules its own save path allows and the cookies consent label by a narrow set that keeps links and inline formatting, so a label that still holds script no longer runs it. The field name is escaped in the wrapper class of the cookies consent and text area fields as well, as it already was in the other field types.
• Fixed: The info icon of the “powered by wpDiscuz” line below the comments carried its behaviour in an inline onclick attribute, which a Content Security Policy that forbids inline script blocks outright, leaving the icon unresponsive with nothing to explain why. It also reached the link through fixed element ids, so a page showing more than one comment form always toggled the first one, and it could not be reached from the keyboard at all. The icon is now handled from wpdiscuz.js, is operable by keyboard, toggles the block it belongs to, and moves focus to the link it reveals.
• Fixed: The minimal theme carried none of the styles for the “powered by wpDiscuz” line. That stylesheet loads instead of the default theme one rather than alongside it, so the wpDiscuz link was shown permanently and unstyled, and the info icon beside it toggled nothing a reader would notice.
• Fixed: The HTML field printed its markup on the comment form without being filtered. The markup is cleaned when the form is saved, but that only applies to what is saved from then on, so an HTML field stored before v7.6.13 kept whatever markup it was given and was still printed as markup to every visitor, and cloning a form or importing one copies such a value across untouched. It is now filtered where it is printed, by the same rules its own save path allows, so a field that still holds script no longer runs it. Its code is shown as plain text until the field is cleared. The number field description is escaped where it is printed as well, as it already was in the other field types.
• Fixed: The titles of the comment editor toolbar buttons were passed through the translation function a second time where they are printed, against wpDiscuz’s own text domain. The titles are already translated by that point, so the title of a button added by an addon was looked up in a text domain it does not belong to, and a title the addon had already escaped was escaped a second time, which shows the escape sequence itself to the reader in any title holding an apostrophe or an ampersand. The titles are now only escaped where they are printed.
• Fixed: The icon height and the tab title of each card on the settings dashboard, and the icon class of the file attachment button on the comment form, were printed without being escaped. All three are supplied through settings arrays and filters an addon can extend, so a value holding a quote or a tag was printed as markup rather than as the value it was meant to be. They are now escaped where they are printed, as the values beside them already were.
• Fixed: Replies from guests were rejected as spam on sites where an anti-spam plugin fills in its own hidden fields with JavaScript once the page loads, La Sentinelle for instance, while the first comment posted through the main form went through. A reply form is built by copying the markup of a hidden form on the page, and markup carries the values the page was served with rather than the ones those scripts set, so every reply went out with an untouched honeypot and timer. A second comment from the main form was rejected the same way, because the form is cleared after a comment is posted and clearing it put those fields back to the values the page was served with. The values the scripts set are now carried into every reply form, and kept when the form is cleared.
• Fixed: Every comment a guest posted was rejected while “Detect spambots posting comments” is enabled in All In One Security, stored as spam or discarded depending on its settings. That option rejects a guest comment that arrives without its hidden antibot keys, and it adds those keys only to the comment form WordPress prints itself. wpDiscuz now prints them in its comment, reply and inline feedback forms whenever the option is on. As with the WordPress comment form, a page served from a full-page cache can still carry keys that have expired since, and does not set the cookies its optional cookie check needs.
• Fixed: Inline feedback comments were sent without the fields anti-spam plugins add to comment forms. The feedback form is loaded after the page, and those plugins only add their fields to the comment form, so a plugin that treats a missing field as spam, La Sentinelle for instance, rejected every feedback comment from a guest. A feedback comment is now sent with the Akismet and La Sentinelle fields of the comment form on the same page. The new wpdiscuz_antispam_field_prefixes filter adds the input and textarea fields of other plugins by the start of their names, and the same list decides which fields keep their values when a comment form is cleared.
• Fixed: Sending a comment again after it was stored as spam showed WordPress’s “Duplicate comment detected” error instead of wpDiscuz’s message for a rejected comment. WordPress refuses a comment identical to one it has already stored, spam included, and that refusal was passed on to the commenter as it was. The retry now gets the rejected comment message, “Your comment was not published.” by default, and nothing new is stored. The wpdiscuz_comment_rejected_response filter runs for the retry as well, with the earlier comment and a new fourth argument set to true, so a plugin that explained the first rejection can tell the retry apart. A comment that repeats a published one, or one awaiting approval, still shows the duplicate error.