520 matches found
Jetpack <= 6.4.2 - Authenticated Stored Cross-Site Scripting (XSS)
According to RIPS Technologies: "RIPS detected a Stored XSS vulnerability that affects a module available to premium and professional users of Jetpack. Attackers who gained control over an account on the target site with at least Contributor privileges were able to inject arbitrary JavaScript cod...
Automattic: Stored XSS in Jetpack's Simple Payment Module by Contributors / Authors
Jetpack's implementation of the Simple Payment Module is as follows: A custom post type is registered for each product. When an admin creates a product, a post is internally created and information about the product, such as the price is then stored as post meta information. After the post has be...
Woocommerce Jetpack <= 3.7.0 - XSS
The Booster for WooCommerce WordPress plugin was affected by a XSS security vulnerability...
WordPress Jetpack plugin cross-site scripting vulnerability (CNVD-2018-01270)
WordPress is the WordPress Software Foundation's set of blogging platform using PHP language development, the platform supports in PHP and MySQL server set up a personal blog site. Jetpack is one of the plugin package contains a variety of features such as social sharing, social login and social...
WordPress Jetpack plugin cross-site scripting vulnerability
WordPress is the WordPress Software Foundation's set of blogging platform using PHP language development, the platform supports in PHP and MySQL server set up a personal blog site. Jetpack is one of the plugin package contains a variety of features such as social sharing, social login and social...
Design/Logic Flaw
The Jetpack plugin before 4.0.4 for WordPress has XSS via the Likes module...
Design/Logic Flaw
The Jetpack plugin before 4.0.3 for WordPress has XSS via a crafted Vimeo link...
CVE-2016-10706
The Jetpack plugin before 4.0.3 for WordPress has XSS via a crafted Vimeo link...
CVE-2016-10706
The Jetpack plugin before 4.0.3 for WordPress has XSS via a crafted Vimeo link...
CVE-2016-10705
The Jetpack plugin before 4.0.4 for WordPress has XSS via the Likes module...
CVE-2016-10705
The Jetpack plugin before 4.0.4 for WordPress has XSS via the Likes module...
CVE-2016-10706
The Jetpack plugin before 4.0.3 for WordPress has XSS via a crafted Vimeo link...
CVE-2016-10705
The CVE-2016-10705 entry concerns the Jetpack WordPress plugin prior to version 4.0.4, where the Likes module allows cross-site scripting (XSS). The vulnerability is documented across multiple sources (NVD, Red Hat security, CVE databases, WPVulndb) with consistent wording: XSS via the Likes modu...
CVE-2016-10706
The CVE-2016-10706 affects the WordPress Jetpack plugin prior to version 4.0.3. A cross-site scripting (XSS) vulnerability can be triggered by a specially crafted Vimeo link. Public sources (NVD/Red Hat/CNVD) confirm the issue as a vulnerability in Jetpack’s handling of Vimeo content; the cited r...
CVE-2016-10705
The Jetpack plugin before 4.0.4 for WordPress has XSS via the Likes module...
CVE-2016-10706: Improper Neutralization of Input During Web Page Generation
The Jetpack plugin before 4.0.3 for WordPress has XSS via a crafted Vimeo link...
CVE-2016-10705: Improper Neutralization of Input During Web Page Generation
The Jetpack plugin before 4.0.4 for WordPress has XSS via the Likes module...
Electroneum: Hackerone [Mainsite Vulnerability]
96 Hello, I was checking out the website Electroneum – Crowdfunding Token Sale – Electroneum – the mobile based cryptocurrency for any vulnerabilities through hackerone. I would like to submit a vulnerability for consideration towards a bounty. Currently you have the file...
Remote Code Execution (RCE)
Automattic/jetpack is vulnerable to remote code execution RCE attacks. The library does not properly escape csv fields, allowing a malicious user to inject a formula that will be executed by the system when the Download as a CSV feature is used...