What’s Vulnerable › Vulnerabilities

CVE-2024-10075: Jetpack < 13.8 - Unauthenticated Arbitrary Block & Shortcode Execution

• Severity: medium (CVSS 5.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-05-15 · updated 2026-06-17

Description

The Jetpack WordPress plugin before 13.8 does not ensure that the post created by the Contact Form is only accessible to authorised users, which could allow unauthenticated users to run arbitrary shortcodes and block.

Affected products

• Jetpack: before 13.8 — fixed in 13.8

How to fix

Upgrade to a fixed version: Jetpack 13.8. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/a984976c-291a-4f68-90d4-e452605ea7d1/
• https://wpscan.com/vulnerability/a984976c-291a-4f68-90d4-e452605ea7d1/

Get alerted when CVE-2024-10075 or the next vulnerability affects your stack