CVE-2024-10858

6.1 mediumEPSS 0.4%

Medium (6.1) in automattic jetpack. EPSS 0.4% chance of exploitation in the next 30 days.

The Jetpack WordPress plugin before 14.1 does not properly checks the postmessage origin in its 13.x versions, allowing it to be bypassed and leading to DOM-XSS. The issue only affects websites hosted on WordPress.com.

Severity

CVSS 3.1

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 34% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2024-12-25
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

automattic:jetpack

References

https://wpscan.com/vulnerability/7fecba37-d718-4dd4-89f3-285fb36a4165/
https://wpscan.com/vulnerability/7fecba37-d718-4dd4-89f3-285fb36a4165/

Check your stack JSON