CVE-2023-54332

5.1 mediumEPSS 0.3%

Medium (5.1) in automattic jetpack. EPSS 0.3% chance of exploitation in the next 30 days.

Jetpack 11.4 contains a cross-site scripting vulnerability in the contact form module that allows attackers to inject malicious scripts through the post_id parameter. Attackers can craft malicious URLs with script payloads to execute arbitrary JavaScript in victims' browsers when they interact with the contact form page.

Severity

CVSS 4.0

5.1 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

CVSS 3.1

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 21% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2026-01-13
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

automattic:jetpack

References

https://wordpress.org/plugins/jetpack
https://www.exploit-db.com/exploits/51104
https://www.vulncheck.com/advisories/jetpack-cross-site-scripting-xss

Check your stack JSON