CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2023-45050 – WordPress Jetpack Plugin <= 12.8-a.1 is vulnerable to Cross Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2023-45050
16 Nov 2023 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic Jetpack – WP Security, Backup, Speed, & Growth allows Stored XSS.This issue affects Jetpack – WP Security, Backup, Speed, & Growth: from n/a through 12.8-a.1. Vulnerabilidad de neutralización inadecuada de la entrada durante la generación de páginas web ('Cross-site Scripting') en Automattic Jetpack – WP Security, Backup, Speed, & Growth permite almacenar XSS. Este problema afecta a Jetpack –... • https://patchstack.com/articles/authenticated-stored-xss-in-woocommerce-and-jetpack-plugin?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 1CVE-2023-2996 – Jetpack < 12.1.1 - Author+ Arbitrary File Manipulation via API
https://notcve.org/view.php?id=CVE-2023-2996
30 May 2023 — The Jetpack WordPress plugin before 12.1.1 does not validate uploaded files, allowing users with author roles or above to manipulate existing files on the site, deleting arbitrary files, and in rare cases achieve Remote Code Execution via phar deserialization. The Jetpack plugin for WordPress is vulnerable to arbitrary file manipulation in versions up to, and including, 12.1. This is due to insufficient validation on data being supplied to the media API endpoint. This makes it possible for authenticated att... • https://jetpack.com/blog/jetpack-12-1-1-critical-security-update • CWE-20: Improper Input Validation •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 1CVE-2021-24374 – Jetpack < 9.8 - Carousel Module Non-Published Page/Post Attachment Comment Leak
https://notcve.org/view.php?id=CVE-2021-24374
01 Jun 2021 — The Jetpack Carousel module of the JetPack WordPress plugin before 9.8 allows users to create a "carousel" type image gallery and allows users to comment on the images. A security vulnerability was found within the Jetpack Carousel module by nguyenhg_vcs that allowed the comments of non-published page/posts to be leaked. El módulo Jetpack Carousel del plugin JetPack de WordPress versiones anteriores a 9.8, permite a usuarios crear una galería de imágenes de tipo "carousel" y permite a usuarios comentar las ... • https://jetpack.com/2021/06/01/jetpack-9-8-engage-your-audience-with-wordpress-stories • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2016-10706 – Jetpack <= 4.0.2 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2016-10706
26 Apr 2017 — The Jetpack plugin before 4.0.3 for WordPress has XSS via a crafted Vimeo link. El plugin Jetpack en versiones anteriores a la 4.0.3 para WordPress tiene XSS mediante un enlace Vimeo manipulado. • https://jetpack.com/2016/05/27/jetpack-4-0-3-critical-security-update • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2016-10705 – Jetpack <= 4.0.3 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2016-10705
20 Jun 2016 — The Jetpack plugin before 4.0.4 for WordPress has XSS via the Likes module. El plugin Jetpack en versiones anteriores a la 4.0.4 para WordPress tiene XSS mediante el módulo Likes. • https://jetpack.com/2016/06/20/jetpack-4-0-4-bug-fixes • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2015-9359 – Jetpack <= 3.4.2 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2015-9359
20 Apr 2015 — The Jetpack plugin before 3.4.3 for WordPress has XSS via add_query_arg() and remove_query_arg(). El plugin Jetpack anterior a 3.4.3 para WordPress tiene una vulnerabilidad XSS a través de add_query_arg () y remove_query_arg (). • https://blog.sucuri.net/2015/04/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.1EPSS: 0%CPEs: 35EXPL: 0CVE-2014-0173 – Jetpack < 2.9.3 - Security Bypass
https://notcve.org/view.php?id=CVE-2014-0173
21 Apr 2014 — The Jetpack plugin before 1.9 before 1.9.4, 2.0.x before 2.0.9, 2.1.x before 2.1.4, 2.2.x before 2.2.7, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.2, 2.6.x before 2.6.3, 2.7.x before 2.7.2, 2.8.x before 2.8.2, and 2.9.x before 2.9.3 for WordPress does not properly restrict access to the XML-RPC service, which allows remote attackers to bypass intended restrictions and publish posts via unspecified vectors. NOTE: some of these details are obtained from third party information. El plugin Jetpack... • http://jetpack.me/2014/04/10/jetpack-security-update • CWE-264: Permissions, Privileges, and Access Controls CWE-285: Improper Authorization •