CVE-2024-6704 describes an HTML Injection vulnerability in the Comments – wpDiscuz plugin for WordPress, affecting all versions up to and including 7.6.21. The issue arises from a lack of filtering of HTML tags in user comments, enabling unauthenticated attackers to insert HTML elements such as hyperlinks when rich editing is disabled. This vulnerability is categorized under CWE-79, indicating improper neutralization of input during web page generation, commonly known as Cross-site Scripting (XSS). The CVSS 3.1 base score is 5.3 (medium), with attack vector network, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, and limited integrity impact.

The vulnerability allows unauthenticated attackers to inject HTML content into comments, potentially leading to Cross-site Scripting attacks. This can result in limited integrity impact, such as the insertion of malicious links or HTML elements in comments visible to users. There is no direct confidentiality or availability impact reported. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling or restricting comment functionality or enabling rich editing features that properly sanitize input. Monitor vendor channels for updates and apply patches promptly once released.