CVE-2023-45050

概要

参考情報

• patchstack.com/articles/authenticated-stored-xss-in-woocommerce-and-jetpack-plugin · Exploit
• patchstack.com/database/vulnerability/jetpack/wordpress-jetpack-plugin-12-8-a-1-cross-site-scripting-xss-vulnerability · Third Party Advisory

jetpack のその他の脆弱性

• CVE-2023-54332中 6.1Jetpack 11.4 contains a cross-site scripting vulnerability in the contact form module that allows attackers to inject malicious scripts thro…
• CVE-2024-10076中 5.9The Jetpack WordPress plugin before 13.8, Jetpack Boost WordPress plugin before 3.4.8 use regexes in the Site Accelerator features when sw…
• CVE-2024-10075中 5.6The Jetpack WordPress plugin before 13.8 does not ensure that the post created by the Contact Form is only accessible to authorised users, …
• CVE-2024-10858中 6.1The Jetpack WordPress plugin before 14.1 does not properly checks the postmessage origin in its 13.x versions, allowing it to be bypassed a…
• CVE-2024-9926中 4.3The Jetpack WordPress plugin does not have proper authorisation in one of its REST endpoint, allowing any authenticated users, such as subsc…