Medium severity · published May 15, 2025
CVE-2024-10076
Jetpack < 13.8, Boost < 3.4.8 - Contributor+ Stored XSS
5.9
CVSS
0.3%
EPSS
No
On KEV
Description
The Jetpack WordPress plugin before 13.8, Jetpack Boost WordPress plugin before 3.4.8 use regexes in the Site Accelerator features when switching image URLs to their CDN counterpart. Unfortunately, some of them may match patterns it shouldn’t, ultimately making it possible for contributor and above users to perform Stored XSS attacks
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JE
Jetpack ·
before 13.8 · source: vendor, NVD
JB
Jetpack Boost ·
before 3.4.8 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-10076
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-10076
Third Party Advisory
https://wpscan.com/vulnerability/15f278f6-0418-4c83-b925-b1a2d8c53e2f/
More from Jetpack
6.1
CVE-2024-10858
Jetpack 13.0-14.0 - Unauthenticated DOM-XSS
5.6
CVE-2024-10075
Jetpack < 13.8 - Unauthenticated Arbitrary Block & Shortcode Execution
4.3
CVE-2024-9926
Jetpack < 13.9.1 - Subscriber+ Arbitrary Feedback Access