This vulnerability (CVE-2024-29804) in the Team Heateor Fancy Comments WordPress plugin is a stored cross-site scripting (CWE-79) issue caused by improper input neutralization during web page generation. It affects versions through 1.2.14 and allows an attacker with low privileges to inject malicious scripts that execute when other users view the affected content. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, required privileges, user interaction, and partial impact on confidentiality, integrity, and availability. No patch or official remediation level has been provided by the vendor as of the published date.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected site, potentially leading to partial confidentiality, integrity, and availability impacts. This could include actions such as session hijacking, defacement, or other malicious activities performed with the privileges of the affected user. However, exploitation requires user interaction and low privileges, which somewhat limits the attack scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider limiting user privileges and monitoring for suspicious activity related to the Fancy Comments plugin. Avoid enabling untrusted user input that could be stored and rendered by the plugin. No official patch or temporary fix has been announced as of the current information.