Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-6704: WordPress wpDiscuz Plugin Allows Attackers to Add Links to Comments

CVE-2024-6704 · published 2 years ago

Summary

The Comments – wpDiscuz plugin for WordPress doesn't check comments for malicious code. This means attackers can add links to comments without needing a password. If you use this plugin, update it to the latest version to prevent this risk.

What to do

Update gvectors wpdiscuz to version 7.6.22 or later.

Affected software

Vendor	Product	Affected versions
gvectors	wpdiscuz	< 7.6.22 `cpe:2.3:a:gvectors:wpdiscuz::::::wordpress::*`

Original advisory text

The Comments – wpDiscuz plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 7.6.21. This is due to a lack of filtering of HTML tags in comments. This makes it possible for unauthenticated attackers to add HTML such as hyperlinks to comments when rich editing is disabled.

References

https://plugins.trac.wordpress.org/browser/wpdiscuz/trunk/class.WpdiscuzCore.php... Product
https://plugins.trac.wordpress.org/changeset/3124810/ Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/fa3501a4-7975-4f90-803... Third Party Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

6.1 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

Timeline

Published2 Aug 2024

Updated4 Nov 2026

First seen7 Mar 2026

Sources

CVE-2024-6704 · NVD

Track software like this

Free during beta