⛔ Post Comments widget includes a class with the username of each comment author about elementor

[79ho3ein]

@nicholaszein

[nicholaszein]

@79ho3ein this is not the place to submit security reports.

Please use the bounty program.

https://elemn.to/bug-bounty

[nicholaszein]

Hello @79ho3ein,

after further investigation we concluded this is neither a security issue, nor something caused by Elementor.

For compatibility reasons, Elementor Pro's Post Comments widget utilizes the same methods any Theme would use to display comments on a document. These methods follow WordPress Coding Standards (WPCS) and use the built-in comments_template() function (see documentation here), which in turns uses the wp_list_comments() function (see documentation here) to render the HTML for each comment.

Since this is part of WordPress Core, it's safe to conclude it does not pose a threat to security, otherwise it would have been long patched by WordPress.

From the code in the ../wp-includes/comment-template.php file (used by wp_list_comments()), more specifically on line 525, you can see that class fetches the $user->nicename which is what you saw in the CSS of the Post Comments widget.

If you are concerned about what classes are added to the comments, you can use the filter add_filter('comment_class') to change the output of comment classes. You can learn more about this filter in this link: https://developer.wordpress.org/reference/hooks/comment_class/.

To avoid compatibility issues, Elementor won't change the output of these classes.

I hope this clarifies your concerns.

Kind regards.