Jetpack Boost Vulnerabilities

[en] The Jetpack WordPress plugin before 13.8, Jetpack Boost WordPress plugin before 3.4.8 use regexes in the Site Accelerator features when switching image URLs to their CDN counterpart. Unfortunately, some of them may match patterns it shouldn’t, ultimately making it possible for contributor and above users to perf...

Affected:

up to 3.4.8

Fixed in:

3.4.8

Disclosed:

May 15, 2025

CVE-2024-10076 on NVD →

The Jetpack plugin for WordPress, versions less than and equal to 13.7, and the Jetpack Boost plugin for WordPress, versions less than and equal to 3.4.7, are vulnerable to Stored Cross-Site Scripting via the Site Accelerator feature due to insufficient input sanitization and output escaping. This makes it possible for...

CVSS:

6.4

Affected:

up to 3.4.7

Fixed in:

3.4.8

Disclosed:

Oct 17, 2024

CVE-2024-10076 on NVD →

The Jetpack Boost – Website Speed, Performance and Critical CSS plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.4.6 via the wp_ajax_boost_proxy_ig AJAX action. This makes it possible for authenticated attackers, with administrator-level access and above, to make...

CVSS:

5.5

Affected:

up to 3.4.6

Fixed in:

3.4.7

Disclosed:

Jul 8, 2024

CVE-2024-6584 on NVD →

Affected:

up to 3.4.7

Fixed in:

3.4.7

CVE-2024-6584 on NVD →