CVE-2022-50958: Jetpack

Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days.

WordPress Plugin Jetpack 9.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating the post_id parameter. Attackers can craft URLs to the grunion-form-view.php endpoint with script payloads in the post_id parameter to execute arbitrary JavaScript in victim browsers.

Affected products

• Jetpack Jetpack: version 9.1 only

Published 2026-05-10. Last modified 2026-10-06.