Automattic JetPack

Jetpack < 12.1.1 - Author+ Arbitrary File Manipulation via API

WordPress Jetpack plugin < 12.7 - Contributor+ Broken Access Control vulnerability

SQL injection vulnerability in modules/sharedaddy.php in the Jetpack plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.

WordPress Jetpack Plugin <= 12.8-a.1 is vulnerable to Cross Site Scripting (XSS)

Jetpack – WP Security, Backup, Speed, & Growth <= 13.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpvideo Shortcode

The Jetpack plugin before 4.0.3 for WordPress has XSS via a crafted Vimeo link.

The Jetpack plugin before 4.0.4 for WordPress has XSS via the Likes module.

The Jetpack plugin before 3.4.3 for WordPress has XSS via add_query_arg() and remove_query_arg().

Jetpack 13.0-14.0 - Unauthenticated DOM-XSS

Jetpack 11.4 - Cross Site Scripting (XSS)

Jetpack < 13.8, Boost < 3.4.8 - Contributor+ Stored XSS

The Jetpack plugin before 1.9 before 1.9.4, 2.0.x before 2.0.9, 2.1.x before 2.1.4, 2.2.x before 2.2.7, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.2, 2.6.x before 2.6.3, 2.7.x before 2.7.2, 2.8.x before 2.8.2, and 2.9.x before 2.9.3 for WordPress does not properly restrict access to the XML-RPC service, which allows remote attackers to bypass intended restrictions and publish posts via unspecified vectors. NOTE: some of these details are obtained from third party information.

Jetpack < 13.8 - Unauthenticated Arbitrary Block & Shortcode Execution

WordPress Jetpack plugin < 12.7 - Auth. Iframe Injection vulnerability

Jetpack < 9.8 - Carousel Module Non-Published Page/Post Attachment Comment Leak

Jetpack < 13.9.1 - Subscriber+ Arbitrary Feedback Access