CVE-2024-10076

The CVE-2024-10076 issue affects Jetpack WordPress plugin versions prior to 13.8 and Jetpack Boost prior to 3.4.8. The root cause is regexes used in the Site Accelerator feature when switching image URLs to the CDN, which may match patterns it shouldn’t, enabling Stored XSS by contributor+ users....

CVE-2024-6584

CVE-2024-6584 describes an SSRF issue in WordPress Jetpack Boost where the action wp_ajax_boost_proxy_ig lets administrators make GET requests to arbitrary URLs. Public details in connected docs associate this with a WordPress Jetpack Boost vulnerability (Admin+ SSRF) and indicate a fix in Jetpac...