CVE-2023-54332
Medium · 6.1CVSS
6.1
EPSS
0.3%
Published
Jan 13, 2026
CISA due date
—
The record
Jetpack 11.4 contains a cross-site scripting vulnerability in the contact form module that allows attackers to inject malicious scripts through the post_id parameter. Attackers can craft malicious URLs with script payloads to execute arbitrary JavaScript in victims' browsers when they interact with the contact form page.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|