CVE-2021-24374: Jetpack < 9.8 - Carousel Module Non-Published Page/Post Attachment Comment Leak
First published: Mon Jun 21 2021(Updated: )
The Jetpack Carousel module of the JetPack WordPress plugin before 9.8 allows users to create a "carousel" type image gallery and allows users to comment on the images. A security vulnerability was found within the Jetpack Carousel module by nguyenhg_vcs that allowed the comments of non-published page/posts to be leaked.
Credit: contact@wpscan.com contact@wpscan.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Automattic Jetpack | <9.8 | |
| composer/automattic/jetpack | <9.8 | 9.8 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this JetPack WordPress plugin vulnerability?
The vulnerability ID is CVE-2021-24374.
What is the severity of CVE-2021-24374?
The severity of CVE-2021-24374 is medium with a CVSS score of 5.3.
What is the affected software for CVE-2021-24374?
The affected software is JetPack WordPress plugin version up to 9.8.
What is the description of CVE-2021-24374?
CVE-2021-24374 is a security vulnerability in the Jetpack Carousel module of the JetPack WordPress plugin before 9.8 that allows users to create a "carousel" type image gallery and allows users to comment on the images.
Is there a fix available for CVE-2021-24374?
Yes, the fix for CVE-2021-24374 is provided in JetPack WordPress plugin version 9.8.
- collector/nvd-index
- agent/type
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-5hr6-r8h6-wh22
- alias/CVE-2021-24374
- agent/software-canonical-lookup
- agent/references
- agent/severity
- agent/weakness
- agent/author
- agent/description
- collector/nvd-cve
- source/NVD
- agent/softwarecombine
- collector/github-advisory
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/last-modified-date
- agent/tags
- agent/event
- agent/first-publish-date
- vendor/automattic
- canonical/automattic jetpack
- package-manager/composer