CVE-2023-2996

Jetpack WordPress plugin (versions prior to 12.1.1) is affected by a vulnerability where uploaded files are not validated. This allows users with author roles or higher to manipulate existing files, delete arbitrary files, and in rare cases achieve Remote Code Execution via phar deserialization. ...

CVE-2021-24374

CVE-2021-24374 affects the WordPress Jetpack plugin’s Carousel module prior to version 9.8. A vulnerability in the Carousel feature allows comments from non-published pages/posts to be leaked. The issue is documented across multiple references (NVD entry and related advisories) and is attributed ...

CVE-2024-9926

CVE-2024-9926 affects the Jetpack WordPress plugin, where the REST endpoint for Jetpack Contact Form feedback lacked proper authorization. This allows any authenticated user (e.g., a subscriber) to read arbitrary feedback data submitted via the Jetpack Contact Form. Root cause is insufficient acc...

CVE-2014-0173

The CVE-2014-0173 issue concerns the WordPress Jetpack plugin: multiple historical versions (up to 2.9.x before 2.9.3, and older branches) fail to properly restrict access to the XML-RPC service, allowing remote attackers to bypass access controls and publish posts via unspecified vectors. The ro...

CVE-2024-10075

The CVE-2024-10075 entry concerns the WordPress Jetpack plugin (pre-13.8). The vulnerability arises from insufficient access control on posts created by the Contact Form, allowing unauthenticated users to access those posts and potentially execute arbitrary shortcodes. The underlying impact is th...

CVE-2015-9359

The CVE-2015-9359 entry concerns the WordPress Jetpack plugin (pre-3.4.3) with a cross-site scripting (XSS) vulnerability exploitable via add_query_arg() and remove_query_arg(). Affected product: Jetpack plugin for WordPress; vulnerable component/behavior: input/output handling around query arg f...

CVE-2016-10705

The CVE-2016-10705 entry concerns the Jetpack WordPress plugin prior to version 4.0.4, where the Likes module allows cross-site scripting (XSS). The vulnerability is documented across multiple sources (NVD, Red Hat security, CVE databases, WPVulndb) with consistent wording: XSS via the Likes modu...

CVE-2023-45050

CVE-2023-45050 is a Cross-site Scripting (Stored XSS) in Automattic Jetpack – WP Security, Backup, Speed, & Growth (Jetpack) up to version 12.8-a.1. Root cause: improper neutralization of input during web page generation. Affected product: Jetpack plugin for WordPress. Public fix: version 12.8-a....

CVE-2023-47774

CVE-2023-47774 affects Automattic Jetpack. Root cause: improper restriction of rendered UI layers/frames enables clickjacking via iframes. Affected product: Jetpack plugin for WordPress (versions before 12.7). Impact: potential user interactions being manipulated by an attacker through a maliciou...

CVE-2024-4392

CVE-2024-4392 affects the Jetpack – WP Security, Backup, Speed, & Growth WordPress plugin. The vulnerability is a Stored Cross-Site Scripting flaw in the plugin’s wpvideo shortcode present in all versions up to and including 13.3.1, caused by insufficient input sanitization and output escaping on...

CVE-2024-10858

CVE-2024-10858 concerns the Jetpack WordPress plugin (versions 13.x and earlier, with 14.1 as the fixed release). The root cause is improper validation of the postMessage origin, enabling a DOM-based cross-site scripting (XSS) bypass. Impact is DOM-XSS on affected sites, with notes indicating the...

CVE-2023-47788

CVE-2023-47788 affects WordPress Jetpack plugin prior to version 12.7, due to a Missing Authorization/Broken Access Control in WPCom External Media REST endpoints. Affected software: Jetpack before 12.7. Root cause: missing authorization checks allowing unauthorized access to external media REST ...

CVE-2011-4673

CVE-2011-4673 affects the WordPress Jetpack plugin, specifically the modules/sharedaddy.php component. The vulnerability allows remote attackers to execute arbitrary SQL commands via the id parameter, indicating a SQL injection in that file. The issue is tied to the Jetpack plugin for WordPress a...

CVE-2016-10706

The CVE-2016-10706 affects the WordPress Jetpack plugin prior to version 4.0.3. A cross-site scripting (XSS) vulnerability can be triggered by a specially crafted Vimeo link. Public sources (NVD/Red Hat/CNVD) confirm the issue as a vulnerability in Jetpack’s handling of Vimeo content; the cited r...

CVE-2024-10076

The CVE-2024-10076 issue affects Jetpack WordPress plugin versions prior to 13.8 and Jetpack Boost prior to 3.4.8. The root cause is regexes used in the Site Accelerator feature when switching image URLs to the CDN, which may match patterns it shouldn’t, enabling Stored XSS by contributor+ users....

CVE-2023-54332

CVE-2023-54332 affects Jetpack 11.4. The vulnerability is a cross-site scripting flaw in the contact form module that allows attackers to inject scripts via the post_id parameter. Exploitation involves crafting malicious URLs to execute arbitrary JavaScript in victims’ browsers when they interact...