Jetpack and Jetpack Boost WordPress Plugins Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in the Jetpack WordPress plugin versions prior to 13.8 and the Jetpack Boost WordPress plugin versions prior to 3.4.8. The issue arises in the Site Accelerator features, where regular expressions are used to switch image URLs to their CDN counterparts. Some of these regex patterns may inadvertently match unintended content, allowing users with contributor roles and above to execute stored cross-site scripting attacks.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Remediation

Users can update to Jetpack version 13.8 and Jetpack Boost version 3.4.8 to address this vulnerability.