CVE-2023-54332
MEDIUMAutomattic Jetpack - XSS
Title source: ruleDescription
Jetpack 11.4 contains a cross-site scripting vulnerability in the contact form module that allows attackers to inject malicious scripts through the post_id parameter. Attackers can craft malicious URLs with script payloads to execute arbitrary JavaScript in victims' browsers when they interact with the contact form page.
Exploits (1)
exploitdb
WORKING POC
by Behrouz Mansoori · textwebappsphp
https://www.exploit-db.com/exploits/51104
Scores
CVSS v3
6.1
EPSS
0.0005
EPSS Percentile
15.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Details
CWE
CWE-79
Status
published
Products (1)
automattic/jetpack
11.4
Published
Jan 13, 2026
Tracked Since
Feb 18, 2026