CVE-2022-50958

MediumCVSS 6.1

Published: 10/05/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

11th percentile - higher than 11% of all known CVEs

Summary

Reflected XSS in Jetpack plugin 9.1 for WordPress. Unauthenticated attacker can inject malicious script via the post_id parameter in the grunion-form-view.php endpoint.

Risk Assessment

An attacker can execute arbitrary JavaScript in the victim's browser, leading to session theft or account takeover.

Recommendation

Update the Jetpack plugin to the latest version.

Original NVD description (English source)

WordPress Plugin Jetpack 9.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating the post_id parameter. Attackers can craft URLs to the grunion-form-view.php endpoint with script payloads in the post_id parameter to execute arbitrary JavaScript in victim browsers.