Jetpack – WP Security, Backup, Speed, & Growth, 1a116fa108cde0d07f6175075a8c01a62d2aa3a3

CVE, Research URL: 1a116fa108cde0d07f6175075a8c01a62d2aa3a3
Home page URL: Security reports for Jetpack – WP Security, Backup, Speed, & Growth
Application: Jetpack – WP Security, Backup, Speed, & Growth
Published on: Apr 26, 2017
Research Description: Jetpack – WP Security, Backup, Speed, & Growth [jetpack] < 4.2 Jetpack – WP Security, Backup, Speed, & Growth < 4.2 - Reflected Cross-Site Scripting The Jetpack plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the add_query_args() function in versions up to, and including, 4.1.x due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected versions: max 4.2.
Status: vulnerable