PatchTheCVE: commentshttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2020-13870: An issue was discovered in the Comments plugin before 1.5.5 for Craft CMShttps://patchthecve.com/cve/CVE-2020-13870.htmlhttps://patchthecve.com/cve/CVE-2020-13870.htmlWed, 17 Jun 2026 02:53:48 +0000MEDIUM 5.4: An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. There is stored XSS via an asset volume name.CVE-2020-13869: An issue was discovered in the Comments plugin before 1.5.6 for Craft CMShttps://patchthecve.com/cve/CVE-2020-13869.htmlhttps://patchthecve.com/cve/CVE-2020-13869.htmlWed, 17 Jun 2026 02:53:48 +0000MEDIUM 5.4: An issue was discovered in the Comments plugin before 1.5.6 for Craft CMS. There is stored XSS via a guest name.CVE-2020-13868: An issue was discovered in the Comments plugin before 1.5.5 for Craft CMShttps://patchthecve.com/cve/CVE-2020-13868.htmlhttps://patchthecve.com/cve/CVE-2020-13868.htmlWed, 17 Jun 2026 02:53:48 +0000MEDIUM 6.5: An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. CSRF affects comment integrity.CVE-2008-0773: SQL injection vulnerability in Phil Taylor Comments (com_comments, aka Review Script) 0.5.8.5g and earlier comhttps://patchthecve.com/cve/CVE-2008-0773.htmlhttps://patchthecve.com/cve/CVE-2008-0773.htmlTue, 16 Jun 2026 22:50:19 +0000HIGH 7.5: SQL injection vulnerability in Phil Taylor Comments (com_comments, aka Review Script) 0.5.8.5g and earlier component for Mambo allows remote attackers to execute arbitrary SQL commands via the id parameter.