4 matches found
CVE-2022-3342
CVE-2022-3342 (Jetpack CRM – zero BS CRM) is a PHP PHAR deserialization vulnerability in the ZeroBSCRM_CSVImporterLitehtml_app function. In affected WordPress plugin versions up to 5.3.1, nonce checks mis-handle failure and perform a file_exists check on zbscrmcsvimpf; supplying a phar:// archive...
CVE-2022-4497
Summary: CVE-2022-4497 affects the Jetpack CRM WordPress plugin before 5.5. The issue is unvalidated/unescaped shortcode attributes in output, enabling Stored XSS where a user with as little as Contributor can target admins. Several connected sources corroborate the vulnerability: PoC payloads ex...
CVE-2022-3919
The CVE covers Jetpack CRM for WordPress prior to version 5.4.3, where settings sanitization/escaping is insufficient. The vulnerability allows high-privilege users (e.g., admins) to trigger cross-site scripting via the plugin’s settings, even when unfiltered_html is disallowed. The issue is root...