Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4

Export CSV
CVE-2022-50958

WordPress Plugin Jetpack 9.1 Cross Site Scripting via grunion-form-view.php

WordPress Plugin Jetpack 9.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating the post_id parameter. Attackers can craft URLs to the grunion-form-view.php endpoint with script payloads in the post_id parameter to execute arbitrary JavaScript in victim browsers.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Automattic Jetpack Wordpress
Products
Jetpack Boost Jetpack Wordpress
CVE-2023-54332

Jetpack 11.4 - Cross Site Scripting (XSS)

Jetpack 11.4 contains a cross-site scripting vulnerability in the contact form module that allows attackers to inject malicious scripts through the post_id parameter. Attackers can craft malicious URLs with script payloads to execute arbitrary JavaScript in victims' browsers when they interact with the contact form page.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Automattic
Products
Jetpack Jetpack Boost
CVE-2024-6584

Jetpack Boost < 3.4.7 - Admin+ SSRF

The 'wp_ajax_boost_proxy_ig' action allows administrators to make GET requests to arbitrary URLs.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Automattic
Products
Jetpack Boost
CVE-2024-10076

Jetpack < 13.8, Boost < 3.4.8 - Contributor+ Stored XSS

The Jetpack WordPress plugin before 13.8, Jetpack Boost WordPress plugin before 3.4.8 use regexes in the Site Accelerator features when switching image URLs to their CDN counterpart. Unfortunately, some of them may match patterns it shouldn’t, ultimately making it possible for contributor and above users to perform Stored XSS attacks

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Automattic
Products
Jetpack Jetpack Boost