It was fixed in JComments 2.2 (we wrote about this in JComments 2.2 release notes and
www.htbridge.ch site). This is reason we've recommend all users upgrade to JComments 2.2...
But this vulnerability can be exploited only by user who has access to Joomla's backend. In most cases only trusted users has access to backend so in my mind this isn't so dangerous.
