CVE-2014-5347: Multiple cross-site request forgery (CSRF) vulnerabilities in the Disqus Comment System plugin before 2.76...

Security readout for executives and security teams

Older Disqus Comment System plugin versions for WordPress allowed attackers to trick a logged-in administrator into changing plugin settings or triggering stored cross-site scripting behavior. The issue depends on administrator interaction and an affected plugin version, but compromise of an admin session can affect site integrity and visitor trust. Exposure is most likely on legacy WordPress sites still running Disqus Comment System plugin versions earlier than 2.76. Current exposure cannot be inferred from the bundle because affected CPEs, installed-base data, and supported-version status are not provided. Treat as a legacy WordPress exposure cleanup item. Prioritize externally facing WordPress sites, especially high-traffic or brand-sensitive sites, because successful abuse could alter site behavior or inject malicious content through administrator trust. Mitigation focus: Upgrade Disqus Comment System to version 2.76 or a current vendor-supported release.; Remove the plugin if Disqus comments are no longer required.; Limit WordPress administrator access to trusted users and hardened workstations..

Prepared

Jun 14, 2026, 07:14 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.