CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2022-4497 – Jetpack CRM < 5.5 - Contributor+ Stored XSS
https://notcve.org/view.php?id=CVE-2022-4497
The Jetpack CRM WordPress plugin before 5.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins The Jetpack CRM plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcode in versions up to, and including, 5.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. • https://wpscan.com/vulnerability/3fa6c8b3-6b81-4fe3-b997-25c9e5fdec86 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2022-3919 – Jetpack CRM < 5.4.3 - Admin+ Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2022-3919
The Jetpack CRM WordPress plugin before 5.4.3 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. El complemento Jetpack CRM para WordPress anterior a 5.4.3 no sanitiza ni escapa de su configuración, lo que permite a usuarios con privilegios elevados, como el administrador, realizar ataques de Cross-Site Scripting incluso cuando la capacidad unfiltered_html no está permitida. The Jetpack CRM plugin for WordPress is vulnerable to Stored Cross-Site Scripting via some of its settings in versions up to, and including, 5.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. • https://wpscan.com/vulnerability/fe2f1d52-8421-4b46-b829-6953a0472dcb • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 1CVE-2021-24374 – Jetpack < 9.8 - Carousel Module Non-Published Page/Post Attachment Comment Leak
https://notcve.org/view.php?id=CVE-2021-24374
The Jetpack Carousel module of the JetPack WordPress plugin before 9.8 allows users to create a "carousel" type image gallery and allows users to comment on the images. A security vulnerability was found within the Jetpack Carousel module by nguyenhg_vcs that allowed the comments of non-published page/posts to be leaked. El módulo Jetpack Carousel del plugin JetPack de WordPress versiones anteriores a 9.8, permite a usuarios crear una galería de imágenes de tipo "carousel" y permite a usuarios comentar las imágenes. Se encontró una vulnerabilidad de seguridad en el módulo Jetpack Carousel por la función nguyenhg_vcs que permitía filtrar los comentarios de las páginas/posts no publicados • https://jetpack.com/2021/06/01/jetpack-9-8-engage-your-audience-with-wordpress-stories https://wpscan.com/vulnerability/08a8a51c-49d3-4bce-b7e0-e365af1d8f33 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2016-10706 – Jetpack <= 4.0.2 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2016-10706
The Jetpack plugin before 4.0.3 for WordPress has XSS via a crafted Vimeo link. El plugin Jetpack en versiones anteriores a la 4.0.3 para WordPress tiene XSS mediante un enlace Vimeo manipulado. • https://jetpack.com/2016/05/27/jetpack-4-0-3-critical-security-update https://www.wordfence.com/blog/2016/05/jetpack-vulnerability • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2016-10705 – Jetpack <= 4.0.3 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2016-10705
The Jetpack plugin before 4.0.4 for WordPress has XSS via the Likes module. El plugin Jetpack en versiones anteriores a la 4.0.4 para WordPress tiene XSS mediante el módulo Likes. • https://jetpack.com/2016/06/20/jetpack-4-0-4-bug-fixes https://wpvulndb.com/vulnerabilities/8517 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •