Automattic Jetpack Crm — known CVE vulnerabilities

Every CVE whose affected-product data names Automattic Jetpack Crm, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (4)

• CVE-2022-3342 — CVSS 7.5 (high): The Jetpack CRM plugin for WordPress is vulnerable to PHAR deserialization via the ‘zbscrmcsvimpf’ parameter in the…
• CVE-2023-27429 — CVSS 5.9 (medium): Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Automattic - Jetpack CRM team Jetpack CRM plugin <= 5.4.4 versions.
• CVE-2022-4497 — CVSS 5.4 (medium): The Jetpack CRM WordPress plugin before 5.5 does not validate and escape some of its shortcode attributes before outputting them back in…
• CVE-2022-3919 — CVSS 4.8 (medium): The Jetpack CRM WordPress plugin before 5.4.3 does not sanitise and escape its settings, allowing high privilege users such as admin to…