CVE-2023-54332CWE-79

Jetpack 11.4 - Cross Site Scripting (XSS)

Medium · published January 13, 2026

CVSS v4.0
5.1
EPSS
0%
Percentile
20.7
In the wild
Unconfirmed
What it is

Jetpack 11.4 contains a cross-site scripting vulnerability in the contact form module that allows attackers to inject malicious scripts through the post_id parameter. Attackers can craft malicious URLs with script payloads to execute arbitrary JavaScript in victims' browsers when they interact with the contact form page.

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
EPSS
0.00293 · 20.7th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-01-13T22:56Z
EPSS history
Timeline
  • 13 JAN 22:56Z
    Jetpack 11.4 - Cross Site Scripting (XSS)
    cvelistv5