Vulnerabilities > Automattic > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2021-06-21 | CVE-2021-24374 | Authorization Bypass Through User-Controlled Key vulnerability in Automattic Jetpack The Jetpack Carousel module of the JetPack WordPress plugin before 9.8 allows users to create a "carousel" type image gallery and allows users to comment on the images. | 5.3 |
| 2021-06-01 | CVE-2021-24329 | Cross-site Scripting vulnerability in Automattic WP Super Cache The WP Super Cache WordPress plugin before 1.7.3 did not properly sanitise its wp_cache_location parameter in its settings, which could lead to a Stored Cross-Site Scripting issue. | 5.4 |
| 2020-02-07 | CVE-2013-2008 | Cross-site Scripting vulnerability in Automattic WP Super Cache 1.3 WordPress Super Cache Plugin 1.3 has XSS. | 6.1 |
| 2019-08-28 | CVE-2015-9359 | Cross-site Scripting vulnerability in Automattic Jetpack The Jetpack plugin before 3.4.3 for WordPress has XSS via add_query_arg() and remove_query_arg(). | 6.1 |
| 2019-08-28 | CVE-2015-9357 | Cross-site Scripting vulnerability in Automattic Akismet The akismet plugin before 3.1.5 for WordPress has XSS. | 6.1 |
| 2019-07-18 | CVE-2016-10763 | Cross-site Scripting vulnerability in Automattic Camptix Event Ticketing The CampTix Event Ticketing plugin before 1.5 for WordPress allows XSS in the admin section via a ticket title or body. | 4.8 |
| 2018-01-12 | CVE-2016-10706 | Cross-site Scripting vulnerability in Automattic Jetpack The Jetpack plugin before 4.0.3 for WordPress has XSS via a crafted Vimeo link. | 6.1 |
| 2018-01-12 | CVE-2016-10705 | Cross-site Scripting vulnerability in Automattic Jetpack The Jetpack plugin before 4.0.4 for WordPress has XSS via the Likes module. | 6.1 |