PT-2026-2422 · WordPress · Jetpack

Behrouz Mansoori · Publicado 2026-01-13 · Atualizado 2026-01-29 · CVE-2023-54332

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jetpack version 11.4

Description The software contains a cross-site scripting issue within the contact form module. An attacker can inject malicious scripts through the post id parameter. By crafting malicious URLs with script payloads, an attacker can execute arbitrary JavaScript in a victim’s browser when they interact with the contact form page.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the contact form module.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-54332

Produtos afetados

Jetpack

Referências · 8

• 🔥 https://exploit-db.com/exploits/51104 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-54332 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-54332 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2011383028107325594 · Publicação no Twitter
• https://wordpress.org/plugins/jetpack · Nota
• https://twitter.com/VulmonFeeds/status/2011270195138925032 · Publicação no Twitter
• https://vulncheck.com/advisories/jetpack-cross-site-scripting-xss · Nota
• https://t.me/cveNotify/150299 · Publicação no Telegram