CVE-2021-24374: JetPack Exposure of Resource to Wrong Sphere

medium Affects automattic/jetpack, jetpack (WordPress plugin). Feed 2026.10.29.4, updated 2026-10-29; published 2021-06-21; advisory modified 2026-09-10.

JetPack Exposure of Resource to Wrong Sphere

Package: automattic/jetpack Composer
Affected versions: <9.8
Fixed in: 9.8
Severity: medium CVSS 5.3
Exploitation: not on CISA KEV · EPSS 1% (74.1th percentile)
Published: 2022-05-24
Source: osv.dev

References

The Jetpack Carousel module of the JetPack WordPress plugin before 9.8 allows users to create a "carousel" type image gallery and allows users to comment on the images. A security vulnerability was fo

Package: jetpack (WordPress plugin) WordPress
Affected versions: <9.8
Fixed in: 9.8
Severity: medium CVSS 5.3
Exploitation: not on CISA KEV · EPSS 1% (74.1th percentile)
Published: 2021-06-21
Source: nvd

References

CWE-284 CWE-639 CWE-668

NVD record automattic/jetpack advisories jetpack (WordPress plugin) advisories

Am I affected?

Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# PHP projects (recommended)
composer require --dev phpwarden/phpwarden
# then
vendor/bin/phpwarden deps composer.lock

# or, without Composer
pipx install phpwarden   &&   phpwarden deps composer.lock

Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command

Install docs How findings are ranked

Related advisories

CVE-2023-2996 high The Jetpack WordPress plugin before 12.1.1 does not validate uploaded files, allowing user same package: jetpack (WordPress plugin)
CVE-2014-0173 medium The Jetpack plugin before 1.9 before 1.9.4, 2.0.x before 2.0.9, 2.1.x before 2.1.4, 2.2.x same package: jetpack (WordPress plugin)
CVE-2024-9926 medium The Jetpack WordPress plugin does not have proper authorisation in one of its REST endpoin same package: jetpack (WordPress plugin)
CVE-2016-10706 medium The Jetpack plugin before 4.0.3 for WordPress has XSS via a crafted Vimeo link. same package: jetpack (WordPress plugin)
CVE-2016-10705 medium The Jetpack plugin before 4.0.4 for WordPress has XSS via the Likes module. same package: jetpack (WordPress plugin)
CVE-2015-9359 medium The Jetpack plugin before 3.4.3 for WordPress has XSS via add_query_arg() and remove_query same package: jetpack (WordPress plugin)