Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    2 vulnerabilities by gvectorsteam

    CVE-2024-6704 (GCVE-0-2024-6704)

    Vulnerability from nvd – Published: 2024-08-02 10:59 – Updated: 2026-04-08 17:34
    VLAI
    Title
    Comments – wpDiscuz <= 7.6.21 - Unauthenticated HTML Injection
    Summary
    The Comments – wpDiscuz plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 7.6.21. This is due to a lack of filtering of HTML tags in comments. This makes it possible for unauthenticated attackers to add HTML such as hyperlinks to comments when rich editing is disabled.
    Severity
    5.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2024-08-02 15:19 UTC
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    References
    Impacted products
    Vendor Product Version
    advancedcoding Comments – wpDiscuz Affected: 0 , ≤ 7.6.21 (semver)
    		Create a notification for this product.
    gvectorsteam comments-wpdiscuz Affected: 0 , ≤ 7.6.21 (custom)
        cpe:2.3:a:gvectorsteam:comments-wpdiscuz:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Credits
    Tieu Pham Trong Nhan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:gvectorsteam:comments-wpdiscuz:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "comments-wpdiscuz",
            "vendor": "gvectorsteam",
            "versions": [
              {
                "lessThanOrEqual": "7.6.21",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-6704",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-02T15:19:32.566668Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-02T15:30:39.774Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Comments \u2013 wpDiscuz",
          "vendor": "advancedcoding",
          "versions": [
            {
              "lessThanOrEqual": "7.6.21",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Tieu Pham Trong Nhan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Comments \u2013 wpDiscuz plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 7.6.21. This is due to a lack of filtering of HTML tags in comments. This makes it possible for unauthenticated attackers to add HTML such as hyperlinks to comments when rich editing is disabled."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T17:34:19.871Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/fa3501a4-7975-4f90-8037-f8a06c293c07?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wpdiscuz/trunk/class.WpdiscuzCore.php#L335"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3124810/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-08-01T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Comments \u2013 wpDiscuz \u003c= 7.6.21 - Unauthenticated HTML Injection"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2024-6704",
    "datePublished": "2024-08-02T10:59:33.380Z",
    "dateReserved": "2024-07-11T20:24:28.981Z",
    "dateUpdated": "2026-04-08T17:34:19.871Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2024-6704 (GCVE-0-2024-6704)

    Vulnerability from cvelistv5 – Published: 2024-08-02 10:59 – Updated: 2026-04-08 17:34
    VLAI
    Title
    Comments – wpDiscuz <= 7.6.21 - Unauthenticated HTML Injection
    Summary
    The Comments – wpDiscuz plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 7.6.21. This is due to a lack of filtering of HTML tags in comments. This makes it possible for unauthenticated attackers to add HTML such as hyperlinks to comments when rich editing is disabled.
    Severity
    5.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2024-08-02 15:19 UTC
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    References
    Impacted products
    Vendor Product Version
    advancedcoding Comments – wpDiscuz Affected: 0 , ≤ 7.6.21 (semver)
    		Create a notification for this product.
    gvectorsteam comments-wpdiscuz Affected: 0 , ≤ 7.6.21 (custom)
        cpe:2.3:a:gvectorsteam:comments-wpdiscuz:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Credits
    Tieu Pham Trong Nhan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:gvectorsteam:comments-wpdiscuz:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "comments-wpdiscuz",
            "vendor": "gvectorsteam",
            "versions": [
              {
                "lessThanOrEqual": "7.6.21",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-6704",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-02T15:19:32.566668Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-02T15:30:39.774Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Comments \u2013 wpDiscuz",
          "vendor": "advancedcoding",
          "versions": [
            {
              "lessThanOrEqual": "7.6.21",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Tieu Pham Trong Nhan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Comments \u2013 wpDiscuz plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 7.6.21. This is due to a lack of filtering of HTML tags in comments. This makes it possible for unauthenticated attackers to add HTML such as hyperlinks to comments when rich editing is disabled."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T17:34:19.871Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/fa3501a4-7975-4f90-8037-f8a06c293c07?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wpdiscuz/trunk/class.WpdiscuzCore.php#L335"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3124810/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-08-01T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Comments \u2013 wpDiscuz \u003c= 7.6.21 - Unauthenticated HTML Injection"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2024-6704",
    "datePublished": "2024-08-02T10:59:33.380Z",
    "dateReserved": "2024-07-11T20:24:28.981Z",
    "dateUpdated": "2026-04-08T17:34:19.871Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}