CVE-2024-10076

Name of the Vulnerable Software and Affected Versions: Jetpack WordPress plugin versions prior to 13.8 Jetpack Boost WordPress plugin versions prior to 3.4.8

Description: The issue concerns the use of regexes in the Site Accelerator features of the Jetpack and Jetpack Boost WordPress plugins when switching image URLs to their CDN counterpart. Some of these regexes may match patterns they shouldn’t, making it possible for contributor and above users to perform Stored XSS attacks.

Recommendations: For Jetpack WordPress plugin versions prior to 13.8, update to version 13.8 or later. For Jetpack Boost WordPress plugin versions prior to 3.4.8, update to version 3.4.8 or later.