CVE-2024-6704

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The Comments – wpDiscuz plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 7.6.21. This is due to a lack of filtering of HTML tags in comments. This makes it possible for unauthenticated attackers to add HTML such as hyperlinks to comments when rich editing is disabled.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Aug 2, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-67055.5The RegLevel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2.CVE-2024-67066.1Attackers can craft a malicious prompt that coerces the language model into executing arbitrary JavaScript in the context of the web page.CVE-2024-67078.8Attacker controlled files can be uploaded to arbitrary locations on the web server's filesystem by abusing a path traversal vulnerability.CVE-2024-67084.8The User Profile Builder WordPress plugin before 3.12.2 does not sanitise and escape some parameters before outputting its content on the a CVE-2024-67094.3The Sync Post With Other Site plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on t CVE-2024-67105.4The Ditty WordPress plugin before 3.1.45 does not sanitise and escape some parameters, which could allow users with a role as low as Contri CVE-2024-67113.5The Event Tickets with Ticket Scanner WordPress plugin before 2.3.8 does not sanitise and escape some parameters, which could allow users wi CVE-2024-67126.1The MapFig Studio WordPress plugin through 0.2.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, w CVE-2024-67134.8The PVN Auth Popup WordPress plugin through 1.0.0 does not sanitise and escape some of its settings, which could allow high privilege users CVE-2024-67147.8An issue was discovered in provd before version 0.1.5 with a setuid binary, which allows a local attacker to escalate their privilege.CVE-2024-67156.1The Ditty WordPress plugin before 3.1.46 re-introduced a previously fixed security issue (https://wpscan.com/vulnerability/80a9eb3a-2cb1-48 CVE-2024-67178.6HashiCorp Nomad and Nomad Enterprise 1.6.12 up to 1.7.9, and 1.8.1 archive unpacking during migration is vulnerable to path escaping of the