Security Alert Summary
WordPress Plugin Jetpack 9.1 contains a reflected cross-site scripting (XSS) vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating the post_id parameter. Attackers can craft URLs to the grunion-form-view.php endpoint with script payloads in the post_id parameter to execute arbitrary JavaScript in victim browsers.
CVE Details
- CVE ID: CVE-2022-50958
- Affected component: WordPress Plugin Jetpack (as named in the description)
- Affected versions: As stated in the description: Jetpack 9.1
- Published: May 10, 2026 at 1:16:33 PM
- Last modified: May 10, 2026 at 1:16:33 PM
- CVSS v3.1: Base Score 6.1 (MEDIUM) — Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CVSS v4.0: Base Score 5.1 (MEDIUM) — Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Authentication / Privileges / User interaction:
- Authentication required: None (unauthenticated attackers)
- Privileges required: None
- User interaction: Required / Active (an attacker must deliver a crafted URL that a victim opens)
- Primary impact: Confidentiality: Low; Integrity: Low; Availability: None
- Weakness (CWE): CWE-79 (Improper Neutralization of Input During Web Page Generation, reflected XSS)
Technical Details
The vulnerability is a reflected cross-site scripting issue in Jetpack where the post_id parameter in requests to grunion-form-view.php is not properly sanitized or encoded before being reflected back to the client. An attacker can construct a URL containing script payloads in the post_id parameter and convince a user to open that URL. When the victim’s browser renders the response, the injected JavaScript runs in the context of the site.
This allows execution of arbitrary JavaScript in the victim’s browser session. The description specifically identifies the grunion-form-view.php endpoint and the post_id parameter as the injection vector. No additional functions or endpoints are named in the provided data.
How This Could Impact Your Website
In a realistic scenario, an attacker crafts a malicious link to the vulnerable endpoint and sends it to site users. For example, an external contractor or contributor might receive the link and open it while logged into the site, or a site visitor may be tricked into following the URL. If the injected script runs in a browser where user-specific data is visible on the page, the attacker could read or exfiltrate data available to that page context (for example, email addresses shown on a page) or perform actions available to the user within the limits of the page context.
Practical consequences can include exposure of internal user email addresses and an increased risk of targeted phishing or social engineering against staff or contributors. The vulnerability does not, based on the provided data, indicate guaranteed full site compromise, but it does raise the likelihood of targeted abuse against users who interact with crafted links. professional review may be worthwhile if you are unsure whether your site is affected or how to assess your current user roles and plugins.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts and other roles with editing privileges.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity, logs, and user behavior for unusual actions or repeated access to the vulnerable endpoint.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team is happy to help.
