Unrated

Jetpack 13.0-14.0 - Unauthenticated DOM-XSS

CVE-2024-10858 First seen on SecPulse Dec 25, 2024

Original description The description as published by the source.

The Jetpack WordPress plugin before 14.1 does not properly checks the postmessage origin in its 13.x versions, allowing it to be bypassed and leading to DOM-XSS. The issue only affects websites hosted on WordPress.com.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

References

advisory github.com
advisory nvd.nist.gov
report wpscan.com

Key facts

Severity: Unrated
Published: Dec 25, 2024
First seen on SecPulse: Dec 25, 2024

NVD OSV

Detection sources

OSV.dev (Open Source Vulnerabilities)Oct 20, 20:02