CVE Daily

CVE-2024-10858

The Jetpack WordPress plugin before 14.1 does not properly checks the postmessa...

Medium CVSS 6.1

Overview

The Jetpack WordPress plugin before 14.1 does not properly checks the postmessage origin in its 13.x versions, allowing it to be bypassed and leading to DOM-XSS. The issue only affects websites hosted on WordPress.com.

CWE: CWE-79 Published: 2024-12-25T06:15:23.407
Risk analysis

This vulnerability is rated 🟡 MEDIUM.

  • CVSS: 6.1 (MEDIUM)
  • Detected tags: none (tag impact: LOW)

Recommended actions:

  • Prioritize remediation based on business criticality and exposure.
  • Limit exposure and increase monitoring until fixed.

Recommended tools

Tags