CVE-2024-3941

2024-05-1415:42:36

WPScan

web.nvd.nist.gov

wordpress

recaptcha

jetpack

security

vulnerability

csrf

xss

AI Score

5.7

Confidence

High

EPSS

Percentile

9.0%

JSON

The reCAPTCHA Jetpack WordPress plugin through 0.2.2 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged-in admin add Stored XSS payloads via a CSRF attack.

Affected configurations

Vulners

Node

recaptcha_jetpackRange≤0.2.2wordpress

VendorProductVersionCPE
*recaptcha_jetpack*cpe:2.3:a:*:recaptcha_jetpack:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
*	recaptcha_jetpack	*	cpe:2.3:a::recaptcha_jetpack::::::wordpress::

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "reCAPTCHA Jetpack",
    "versions": [
      {
        "status": "affected",
        "versionType": "semver",
        "version": "0",
        "lessThanOrEqual": "0.2.2"
      }
    ],
    "defaultStatus": "affected"
  }
]