Medium severity · published Dec 25, 2024
CVE-2024-10858
Jetpack 13.0-14.0 - Unauthenticated DOM-XSS
6.1
CVSS
0.4%
EPSS
No
On KEV
Description
The Jetpack WordPress plugin before 14.1 does not properly checks the postmessage origin in its 13.x versions, allowing it to be bypassed and leading to DOM-XSS. The issue only affects websites hosted on WordPress.com.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JE
Jetpack ·
13.0 before 14.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-10858
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-10858
Exploit
https://wpscan.com/vulnerability/7fecba37-d718-4dd4-89f3-285fb36a4165/
More from Jetpack
5.9
CVE-2024-10076
Jetpack < 13.8, Boost < 3.4.8 - Contributor+ Stored XSS
5.6
CVE-2024-10075
Jetpack < 13.8 - Unauthenticated Arbitrary Block & Shortcode Execution
4.3
CVE-2024-9926
Jetpack < 13.9.1 - Subscriber+ Arbitrary Feedback Access