CVE-2024-10076

The Jetpack  WordPress plugin before 13.8, Jetpack Boost  WordPress plugin before 3.4.8 use regexes in the Site Accelerator features when switching image URLs to their CDN counterpart. Unfortunately, some of them may match patterns it shouldnt, ultimately making it possible for contributor and above users to perform Stored XSS attacks
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5.9 MEDIUM
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
WPScanCNA
---
---
CISA-ADPADP
5.9 MEDIUM
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 7%
References
https://wpscan.com/vulnerability/15f278f6-0418-4c83-b925-b1a2d8c53e2f/
https://wpscan.com/vulnerability/15f278f6-0418-4c83-b925-b1a2d8c53e2f/