Jetpack 11.4 - Cross Site Scripting (XSS)
Priority MEDIUM 56CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Active
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- None · None · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
Jetpack 11.4 contains a cross-site scripting vulnerability in the contact form module that allows attackers to inject malicious scripts through the post_id parameter. Attackers can craft malicious URLs with script payloads to execute arbitrary JavaScript in victims' browsers when they interact with the contact form page.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00351 28th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Automattic | Jetpack | 11.4 | — | No fix listed | CNA |
- Jetpack VendorAutomattic Affected 11.4 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:automattic:jetpack:11.4:*:*:*:*:wordpress:*:* | 11.4 | Vulnerable | Automattic |
- cpe:2.3:a:automattic:jetpack:11.4:*:*:*:*:wordpress:*:* Versions 11.4 Vulnerable ·Automattic
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2023-54332
- 2026-10-03 Alias added: GHSA-5cjw-xj4m-w5m4
References
Exploit 1
More Automattic Jetpack vulnerabilities
- TI-2023-02806 Jetpack < 12.1.1 - Author+ Arbitrary File Manipulation via API CVSS 3.1HIGH 8.8
- TI-2024-10066 Jetpack 13.0-14.0 - Unauthenticated DOM-XSS CVSS 3.1MEDIUM 6.1
- TI-2024-09340 Jetpack < 13.8, Boost < 3.4.8 - Contributor+ Stored XSS CVSS 3.1MEDIUM 5.9
- TI-2024-09339 Jetpack < 13.8 - Unauthenticated Arbitrary Block & Shortcode Execution CVSS 3.1MEDIUM 5.6
- TI-2023-25898 WordPress Jetpack plugin < 12.7 - Contributor+ Broken Access Control vulnerability CVSS 3.1HIGH 8.8
- TI-2011-04017 SQL injection vulnerability in modules/sharedaddy.php in the Jetpack plugin for WordPress… CVSS 2.0HIGH 7.5
Sources
- CVE-2023-54332 · CVE Program
- CVE-2023-54332 · NVD
- FIRST EPSS
- GHSA-5cjw-xj4m-w5m4 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences