Jetpack CRM – Clients, Leads, Invoices, Billing, Email Marketing, & Automation, CVE-2022-3919

CVE, Research URL: CVE-2022-3919
Home page URL: Security reports for Jetpack CRM – Clients, Leads, Invoices, Billing, Email Marketing, & Automation
Application: Jetpack CRM – Clients, Leads, Invoices, Billing, Email Marketing, & Automation
Published on: Dec 12, 2022
Research Description: The Jetpack CRM WordPress plugin before 5.4.3 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Affected versions: max 5.4.3.
Status: vulnerable

Jetpack CRM &#8211; Clients, Leads, Invoices, Billing, Email Marketing, &amp; Automation, CVE-2022-3919