CVE-2024-3941

2024-05-1415:42:36

[email protected]

web.nvd.nist.gov

wordpress

recaptcha

jetpack

security

vulnerability

csrf

xss

5.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.2%

JSON

The reCAPTCHA Jetpack WordPress plugin through 0.2.2 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged-in admin add Stored XSS payloads via a CSRF attack.

Affected configurations

Vulners

Node

automatticjetpackRange≤0.2.2

VendorProductVersionCPE
automatticjetpack*cpe:2.3:a:automattic:jetpack:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
automattic	jetpack	*	cpe:2.3:a:automattic:jetpack::::::::

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "reCAPTCHA Jetpack",
    "versions": [
      {
        "status": "affected",
        "versionType": "semver",
        "version": "0",
        "lessThanOrEqual": "0.2.2"
      }
    ],
    "defaultStatus": "affected"
  }
]