Filtered by vendor Automattic
Subscriptions
Filtered by product Jetpack Boost
Subscriptions
Total
3 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2023-54332 | 1 Automattic | 2 Jetpack, Jetpack Boost | 2026-03-05 | 6.1 Medium |
| Jetpack 11.4 contains a cross-site scripting vulnerability in the contact form module that allows attackers to inject malicious scripts through the post_id parameter. Attackers can craft malicious URLs with script payloads to execute arbitrary JavaScript in victims' browsers when they interact with the contact form page. | ||||
| CVE-2024-6584 | 1 Automattic | 1 Jetpack Boost | 2025-06-11 | 9.1 Critical |
| The 'wp_ajax_boost_proxy_ig' action allows administrators to make GET requests to arbitrary URLs. | ||||
| CVE-2024-10076 | 1 Automattic | 2 Jetpack, Jetpack Boost | 2025-06-04 | 5.9 Medium |
| The Jetpack WordPress plugin before 13.8, Jetpack Boost WordPress plugin before 3.4.8 use regexes in the Site Accelerator features when switching image URLs to their CDN counterpart. Unfortunately, some of them may match patterns it shouldn’t, ultimately making it possible for contributor and above users to perform Stored XSS attacks | ||||
Page 1 of 1.