Filtered by vendor Automattic Subscriptions
Filtered by product Jetpack Subscriptions
Total 9 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-2996 1 Automattic 1 Jetpack 2024-12-05 8.8 High
The Jetpack WordPress plugin before 12.1.1 does not validate uploaded files, allowing users with author roles or above to manipulate existing files on the site, deleting arbitrary files, and in rare cases achieve Remote Code Execution via phar deserialization.
CVE-2023-45050 1 Automattic 1 Jetpack 2024-11-21 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic Jetpack – WP Security, Backup, Speed, & Growth allows Stored XSS.This issue affects Jetpack – WP Security, Backup, Speed, & Growth: from n/a through 12.8-a.1.
CVE-2021-24374 1 Automattic 1 Jetpack 2024-11-21 5.3 Medium
The Jetpack Carousel module of the JetPack WordPress plugin before 9.8 allows users to create a "carousel" type image gallery and allows users to comment on the images. A security vulnerability was found within the Jetpack Carousel module by nguyenhg_vcs that allowed the comments of non-published page/posts to be leaked.
CVE-2016-10706 1 Automattic 1 Jetpack 2024-11-21 N/A
The Jetpack plugin before 4.0.3 for WordPress has XSS via a crafted Vimeo link.
CVE-2016-10705 1 Automattic 1 Jetpack 2024-11-21 N/A
The Jetpack plugin before 4.0.4 for WordPress has XSS via the Likes module.
CVE-2015-9359 1 Automattic 1 Jetpack 2024-11-21 N/A
The Jetpack plugin before 3.4.3 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVE-2014-0173 1 Automattic 1 Jetpack 2024-11-21 N/A
The Jetpack plugin before 1.9 before 1.9.4, 2.0.x before 2.0.9, 2.1.x before 2.1.4, 2.2.x before 2.2.7, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.2, 2.6.x before 2.6.3, 2.7.x before 2.7.2, 2.8.x before 2.8.2, and 2.9.x before 2.9.3 for WordPress does not properly restrict access to the XML-RPC service, which allows remote attackers to bypass intended restrictions and publish posts via unspecified vectors. NOTE: some of these details are obtained from third party information.
CVE-2011-4673 2 Automattic, Wordpress 2 Jetpack, Wordpress 2024-11-21 N/A
SQL injection vulnerability in modules/sharedaddy.php in the Jetpack plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2024-9926 1 Automattic 1 Jetpack 2024-11-08 4.3 Medium
The Jetpack WordPress plugin does not have proper authorisation in one of its REST endpoint, allowing any authenticated users, such as subscriber to read arbitrary feedbacks data sent via the Jetpack Contact Form