Comments – wpDiscuz

Zapis promijena

IMPORTANT!

Please remember to delete all caches and purge CDN after the update.

Comments – wpDiscuz v7.6.70 – 11.09.2026

• Fixed: Vote buttons showed guests the wrong state and tooltip when “Allow Guests to Vote for Comments” is disabled (buttons looked active, or blamed the visitor's IP address, then clicking answered “You Must Be Logged In To Vote”).
• Fixed: Guests whose IP address is removed by a privacy plugin or a pre_comment_user_ip filter all shared a single post-rating identity. The first such guest locked the rating for every other one, or overwrote it when “Enable rate editing” is enabled, and they were all counted as one rating in the post average and rating count. Guest rating now requires a usable IP address, the same way comment voting has since 7.6.67.
• Fixed: The “Enable rate editing” form setting never reached the front-end script, so the confirmation before changing an existing rating was never asked. The form settings were read one line before they were loaded.
• Added: The wpdiscuz_post_rating() template tag prints the standalone Article Rating anywhere in a theme or page builder template, and wpdiscuz_get_post_rating() returns the same HTML. Pass a post ID to display that post's rating with its own form settings, or pass false as the second argument for read-only output. WooCommerce products continue to use WooCommerce's own rating.
• Added: The [wpdiscuz_post_rating] shortcode provides the same output for page builders and content editors, with post_id, can_rate, and page_rating attributes. Disable unneeded built-in Article Rating positions to avoid displaying the rating more than once.
• Fixed: Pages displaying more than one Article Rating repeated the wpd-post-rating id and sent every rating click to the post of the page. Each rating is now a .wpd-post-rating element carrying its own post ID, so any eligible post can be rated wherever the wpDiscuz script is loaded. The legacy id remains on the page's own rating at the first checked built-in position, or on a manual placement when no position is checked.
• Fixed: The Article Rating schema was repeated whenever the page's own rating appeared more than once. It now follows the rating that owns the legacy id. The template tag's third argument and the shortcode's page_rating attribute can explicitly give or deny a manual placement that ownership when the settings cannot determine it.
• Fixed: “Display ratings on non-singular pages” loaded a stylesheet that did not style the Article Rating block. The standalone rating styles now cover it and use the configured star colours, allowing template-tag and shortcode ratings to display read-only on archives, listings, and other pages where the wpDiscuz script is not loaded when that option is enabled.
• Fixed: Selecting comment attachments more than once replaced the files already selected. New selections now accumulate up to the configured limit, and duplicate files are ignored.

Comments – wpDiscuz v7.6.69 – 07.09.2026

• Fixed: Logging in with X (Twitter) ended on a blank page showing “0” instead of signing the visitor in. The callback URL and the requested scopes were placed in the authorization request without being URL-encoded.
• Fixed: The Stick and Close actions under a comment on the WordPress Comments page never completed. The requests carried no wpDiscuz nonce, so they were rejected with “Nonce is invalid.” and the button spinner kept turning. Both buttons also restore their icon now when a request fails, instead of spinning forever.
• Improved: The Google social login button now uses the official multicolor Google “G” logo.

Comments – wpDiscuz v7.6.68 – 03.09.2026

• Added: The wpdiscuz_comment_rejected_response filter lets moderation plugins provide a clear explanation when a new comment is stored as spam or trash.
• Fixed: Main and inline comment forms now show a moderation plugin's rejection explanation while keeping the standard wpDiscuz spam or trash phrase when no plugin provides one.
• Fixed: Inline comments stored as spam or trash no longer create subscription records or send mention notifications.
• Fixed: Comment insertion failures, including duplicate-comment and flood checks, now return a valid AJAX error instead of terminating the request with an unusable response.
• Fixed: Plus signs and encoded data are preserved in inline commenter names and email addresses, the comment-author email cookie, and submitted website URLs.
• Improved: The Phrases screen now identifies the spam and trash rejection fields separately.
• Improved: Voting buttons now stay visible in a disabled state for visitors who cannot vote on a comment, instead of being hidden. Hiding them left visitors unaware that the site has voting at all. The buttons carry a wpd-vote-disabled class and a tooltip with the reason, and clicking one still shows the existing message.
• Added: The wpdiscuz_hide_readonly_vote_buttons filter hides those buttons again, restoring the wpd-vote-readonly markup used before this release.
• Security: The Google Client Secret is no longer included in the front-end JavaScript settings.

Comments – wpDiscuz v7.6.67 – 29.08.2026

• Fixed: Registered users can vote independently when they share an IP address, while registered authors are still blocked from voting on their own comments with the correct message.
• Fixed: Guests no longer fall into one shared voting identity when privacy software removes visitor IP addresses. Affected guests must log in to vote even when guest voting is enabled.
• Added: The wpdiscuz_deny_vote_from_same_ip filter lets site owners show voting buttons and allow votes for same-IP guest comments without changing registered-user voting. Guests on that IP still share one voting identity.
• Fixed: Vote totals remain visible when voting buttons are hidden by self-vote restrictions, and wpdiscuz_show_vote can now reliably hide other eligible voting components.
• Fixed: Disabling comment voting now blocks the vote action through both native WordPress AJAX and the custom wpDiscuz AJAX endpoint.
• Improved: The voting settings now explain the global request gate and IP-based guest identity, including shared-IP behavior and the login requirement when no visitor IP is available.
• Note: Existing vote records and totals are preserved; this update changes future voting behavior and does not recalculate historical votes.

Comments – wpDiscuz v7.6.66 – 27.08.2026

• Security: Fixed an unauthenticated comment disclosure vulnerability in AJAX comment loading. Reported by Jakub Herman via WPScan.

Comments – wpDiscuz v7.6.65 – 25.08.2026

• Added: The Reviews add-on teaser lists the new “Allow guest reviews” option.
• Improved: The settings search shows which email a result belongs to. Eight options are labelled “Email subject” and eight “Email content”, so a search for “email” returned an indistinguishable list; every result now carries its section, such as “Subscription Type: Post new comment”.
• Improved: The settings search also matches those section names, so searching for “mentioned” or “follow confirmation” finds the email templates belonging to them.
• Improved: A settings search result for one of the email templates now opens the accordion holding it, instead of leaving the option hidden behind a collapsed panel.
• Fixed: A settings search result for an option inside a collapsed accordion scrolled to the top of the page instead of to the option, because the scroll measured the option row while it was still hidden and a hidden row reports a position of zero.
• Fixed: Clicking a second settings search result belonging to an accordion that was already open closed it, because the accordion was toggled rather than opened.
• Fixed: The Reviews add-on teaser said the WooCommerce ratings import skips guest reviews. The import includes them.
• Fixed: The Reviews add-on teaser described the review gate as limiting who may submit a review. It sets submitted reviews to pending and does not vet users.
• Added: wpdScrollToOption() is exposed on the window object, so an add-on whose options sit in an accordion of its own can scroll to an option once it has opened it.
• Fixed: The comment editing information printed only the edit icon, without the name of the editor and the time of the edit, on websites whose phrases table does not contain the “Last edited %1$s by %2$s” phrase.
• Improved: Saved phrases are now merged into the default phrases instead of replacing them. Phrases introduced by a plugin update are no longer printed empty on websites where the phrases table has not been filled with them yet, which happens when the plugin is updated without the WordPress dashboard ever being opened.
• Improved: The comment editing information is not printed at all when its phrase is empty, instead of printing a lone edit icon which tells nothing about who edited the comment and when.
• Removed: The Phrases settings page had fields for the VKontakte and Odnoklassniki share button titles. Those share buttons are no longer part of wpDiscuz and the two phrases behind the fields were neither defined nor saved anywhere, so the page raised an “Undefined array key” warning on every load.
• Fixed: Visitors whose email address contains an apostrophe could not subscribe to comments. The address was checked for validity before the backslash WordPress puts in front of the apostrophe was removed, so the subscription form rejected it and reported nothing.
• Fixed: Comment subscriptions were looked up by matching the email address as a SQL pattern instead of comparing it exactly. Since the % and _ characters are allowed in an email address, a subscriber using such an address matched the other subscribers of the same post, received their unsubscribe link, and removed their comment thread subscriptions.