Executive brief
Jetpack is a widely used WordPress plugin that provides security, performance, and marketing tools for websites. A security flaw in version 9.1 allows attackers to trick users into clicking a malicious link that executes unauthorized code in their web browser. This could lead to unauthorized actions being performed on the website or the theft of sensitive session information.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in the WordPress Jetpack plugin version 9.1. The flaw is located within the grunion-form-view.php endpoint, which fails to properly sanitize the 'post_id' parameter before rendering it in the browser. An unauthenticated remote attacker can exploit this by crafting a malicious URL containing a JavaScript payload. When a victim visits the link, the script executes within the context of their browser session, potentially allowing for session hijacking or unauthorized administrative actions if the victim is an authenticated site owner. A public proof-of-concept exploit has been disclosed.
Affected products
- Automattic Jetpack 9.1 and possibly earlier
Timeline
- 2022-02-07: other: Vulnerability discovered and exploit title created
- 2022-02-10: other: Exploit published on Exploit-DB
- 2026-05-10: advisory: NVD/VulnCheck advisory published