A stored Cross-Site Scripting (XSS) vulnerability exists in the Jetpack plugin’s Likes block. The avatarURL field was not properly sanitized before rendering, allowing authenticated attackers to inject malicious JavaScript. This script executes in the context of any user viewing a page that includes the affected block.
This vulnerability affects the following application versions:
- Jetpack 13.1
- Jetpack 13.1.1
- Jetpack 13.1-a.5
- Jetpack 13.1-a.7
- Jetpack 13.1-a.9
- Jetpack 13.1-beta
- Jetpack 13.2-a.1
- Jetpack 13.2-a.3
- Jetpack 13.2-a.5