verbb/comments
A Craft CMS plugin for self-hosted comments, threaded replies and moderation.
74%
Total Score
caution
Frequent releases and an active repository are offset by all recent commits coming from one contributor.
Health Score Breakdown
All 18 recent commits came from one contributor, creating a real continuity risk. Organizational ownership provides some ability to hand maintenance off, but no second active contributor is shown.
Composer is used for builds, but no security scanning tools were detected, leaving a modest supply-chain hygiene gap.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
CVE-2020-13870 verbb/comments is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in versions 0.0.0 - 1.5.5. | 0.0.0 - 1.5.5 | Medium |
CVE-2020-13868 verbb/comments is vulnerable to Cross-Site Request Forgery (CSRF) in versions 0.0.0 - 1.5.5. | 0.0.0 - 1.5.5 | Medium |
CVE-2020-13869 verbb/comments is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in versions 0.0.0 - 1.5.5. | 0.0.0 - 1.5.5 | Medium |
Package versions
Maintainers
 Verbb |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 verbb/base Version ^3.0.20 | — | — |
craftcms/cms Version ^5.0.0 | — | — |
theiconic/name-parser Version ^1.0 | — | — |
Weekly Downloads
Info
- Last Published
- 11 hours ago
- Created
- 11 years ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.