The Comments WordPress plugin versions prior to 7.6.60 contain a stored Cross-Site Scripting vulnerability (CWE-79) due to improper escaping of user-supplied URLs within HTML attributes. An unauthenticated attacker can inject malicious JavaScript payloads that execute when other users, including administrators, view the compromised comments. This vulnerability can lead to session hijacking, privilege escalation, or other attacks facilitated by script execution in the victim's browser.

Successful exploitation allows unauthenticated attackers to execute arbitrary scripts in the context of the affected site for any user viewing the malicious comment, potentially compromising user sessions or performing actions on behalf of the victim. This affects all users who view the injected content, including administrators, increasing the risk of administrative account compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 7.6.60, upgrading to version 7.6.60 or later is likely recommended once confirmed. Until then, restrict comment posting privileges or implement additional input sanitization as a temporary measure.