Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

4 records

Vendor: Automattic Component: Jetpack Crm Clear all filters
TI-2022-03089 CVE-2022-3342 · GHSA-w42r-qhq4-9fc9

Jetpack CRM <= 5.3.1 - Cross-Site Request Forgery and PHAR Deserialization

Priority MEDIUM 43

The Jetpack CRM plugin for WordPress is vulnerable to PHAR deserialization via the ‘zbscrmcsvimpf’ parameter in the 'zeroBSCRM_CSVImporterLitehtml_app' function in versions up to, and including, 5.3.1.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01269 Published 2023-10-20 No fix listed CWE-502
TI-2022-04111 CVE-2022-4497 · GHSA-fpfr-g8vf-4jhr

Jetpack CRM < 5.5 - Contributor+ Stored XSS

Priority MEDIUM 58

The Jetpack CRM WordPress plugin before 5.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stor…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00573 Published 2023-01-09 Fixed in 5.5
TI-2022-03594 CVE-2022-3919 · GHSA-h78h-f6r8-7qx8

Jetpack CRM < 5.4.3 - Admin+ Cross-Site Scripting

Priority MEDIUM 55

The Jetpack CRM WordPress plugin before 5.4.3 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is dis…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.0053 Published 2022-12-12 Fixed in 5.4.3