PT-2025-21395 · WordPress · Jetpack+1

Marc Montpas · CVE-2024-10076 · Published 2025-05-15 · Updated 2025-05-20

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions: Jetpack WordPress plugin versions prior to 13.8 Jetpack Boost WordPress plugin versions prior to 3.4.8

Description: The issue concerns the use of regexes in the Site Accelerator features of the Jetpack and Jetpack Boost WordPress plugins when switching image URLs to their CDN counterpart. Some of these regexes may match patterns they shouldn’t, making it possible for contributor and above users to perform Stored XSS attacks.

Recommendations: For Jetpack WordPress plugin versions prior to 13.8, update to version 13.8 or later. For Jetpack Boost WordPress plugin versions prior to 3.4.8, update to version 3.4.8 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-10076

Affected Products

Jetpack

Jetpack Boost

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/10xxx/CVE-2024-10076.json · Exploit
• 🔥 https://wpscan.com/vulnerability/15f278f6-0418-4c83-b925-b1a2d8c53e2f · Exploit
• https://osv.dev/vulnerability/CVE-2024-10076 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-10076 · Security Note
• https://t.me/cvenotify/123076 · Telegram Post
• https://twitter.com/CVEnew/status/1923600451670335648 · Twitter Post