PT-2026-2422 · WordPress · Jetpack

Behrouz Mansoori · Published 2026-01-13 · Updated 2026-01-29 · CVE-2023-54332

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jetpack version 11.4

Description The software contains a cross-site scripting issue within the contact form module. An attacker can inject malicious scripts through the post id parameter. By crafting malicious URLs with script payloads, an attacker can execute arbitrary JavaScript in a victim’s browser when they interact with the contact form page.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the contact form module.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-54332

Affected Products

Jetpack

References · 8

• 🔥 https://exploit-db.com/exploits/51104 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-54332 · Security Note
• https://osv.dev/vulnerability/CVE-2023-54332 · Vendor Advisory
• https://twitter.com/CVEnew/status/2011383028107325594 · Twitter Post
• https://wordpress.org/plugins/jetpack · Note
• https://twitter.com/VulmonFeeds/status/2011270195138925032 · Twitter Post
• https://vulncheck.com/advisories/jetpack-cross-site-scripting-xss · Note
• https://t.me/cveNotify/150299 · Telegram Post