CVSS: 4.3EPSS: 32%CPEs: 101EXPL: 2CVE-2024-9926 – Jetpack < 13.9.1 - Subscriber+ Arbitrary Feedback Access
https://notcve.org/view.php?id=CVE-2024-9926
14 Oct 2024 — The Jetpack WordPress plugin does not have proper authorisation in one of its REST endpoint, allowing any authenticated users, such as subscriber to read arbitrary feedbacks data sent via the Jetpack Contact Form The Jetpack – WP Security, Backup, Speed, & Growth plugin for WordPress is vulnerable to unauthorized access of data due to missing capability checks in the Contact_Form_Endpoint class in various versions version up to, but not including, 13.9.1. This makes it possible for authenticated attackers, ... • https://github.com/m3ssap0/wordpress-jetpack-broken-access-control-vulnerable-application • CWE-862: Missing Authorization •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2023-45050 – WordPress Jetpack Plugin <= 12.8-a.1 is vulnerable to Cross Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2023-45050
16 Nov 2023 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic Jetpack – WP Security, Backup, Speed, & Growth allows Stored XSS.This issue affects Jetpack – WP Security, Backup, Speed, & Growth: from n/a through 12.8-a.1. Vulnerabilidad de neutralización inadecuada de la entrada durante la generación de páginas web ('Cross-site Scripting') en Automattic Jetpack – WP Security, Backup, Speed, & Growth permite almacenar XSS. Este problema afecta a Jetpack –... • https://patchstack.com/articles/authenticated-stored-xss-in-woocommerce-and-jetpack-plugin?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.0EPSS: 21%CPEs: 1EXPL: 1CVE-2023-2996 – Jetpack < 12.1.1 - Author+ Arbitrary File Manipulation via API
https://notcve.org/view.php?id=CVE-2023-2996
30 May 2023 — The Jetpack WordPress plugin before 12.1.1 does not validate uploaded files, allowing users with author roles or above to manipulate existing files on the site, deleting arbitrary files, and in rare cases achieve Remote Code Execution via phar deserialization. The Jetpack plugin for WordPress is vulnerable to arbitrary file manipulation in versions up to, and including, 12.1. This is due to insufficient validation on data being supplied to the media API endpoint. This makes it possible for authenticated att... • https://jetpack.com/blog/jetpack-12-1-1-critical-security-update • CWE-20: Improper Input Validation •