{"id":8276,"date":"2015-10-07T09:00:03","date_gmt":"2015-10-07T15:00:03","guid":{"rendered":"https:\/\/www.siteground.com\/blog\/?p=8276"},"modified":"2025-09-18T14:49:06","modified_gmt":"2025-09-18T14:49:06","slug":"jetpack-xss-security-issue","status":"publish","type":"post","link":"https:\/\/www.siteground.com\/blog\/jetpack-xss-security-issue\/","title":{"rendered":"JetPack XSS Security Issue &#8211; What We Did to Protect You"},"content":{"rendered":"\n<div class=\"wp-block-image\"><figure class=\"aligncenter\"><img loading=\"lazy\" decoding=\"async\" width=\"660\" height=\"200\" src=\"https:\/\/newblog.siteground.com\/en\/wp-content\/uploads\/sites\/2\/2016\/10\/jetpack.jpg\" alt=\"jetpack\" class=\"wp-image-8301\"\/><\/figure><\/div>\n\n\n\n<p><br>On October 1st, a security issue in JetPack, one of the most commonly used WordPress plugins, was disclosed by our partners from Sucuri. The vulnerability was severe because an attacker could exploit the contact form feature of the plugin to insert and execute JavaScript code as an admin of your site. Needless to say, that could lead to all sort of problems &#8211; injecting black SEO links, adding backdoors for full access to your account, accessing private information, etc. In this recap post, we would like to summarise what we did to protect SiteGround users with this plugin installed.<\/p>\n\n\n\n<!--more-->\n\n\n\n<h3 class=\"wp-block-heading\">Added a Rule in Our WAF to Prevent Exploiting the Vulnerability<\/h3>\n\n\n\n<p>Our security team acted immediately on the day the vulnerability was announced and added a special rule to block hacking attempts trying to utilise this exploit in our web application firewall. Basically, we started blocking all requests that match a pattern crafted by our security team. Of course, before applying this firewall rule, we did enough testing to make sure that no real requests to our customers&#8217; sites will be blocked, just the malicious ones. However, doing this does not fix the core of the problem, but simply prevents attacks that try to gain unauthorised access to our customers&#8217; sites through this security hole.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Updated the JetPack plugins of our clients<\/h3>\n\n\n\n<p>After the disclosure of the vulnerability, the Automattic team that developed JetPack has released an update for the plugin. Since we do not like leaving security holes unresolved, we notified all our clients using Jetpack that their plugins would be updated. And just a few days after the disclosure, we had updated 95% of all outdated JetPack plugins on our shared servers. About 5% of the attempted upgrades were unsuccessful, in which case we offered additional assistance to the affected owners.<\/p>\n\n\n<p>[subscribe_cta]<\/p>\n","protected":false},"excerpt":{"rendered":"On October 1st, a security issue in JetPack, one of the most commonly used WordPress plugins, was disclosed by our partners from Sucuri. The vulnerability was severe because an attacker could exploit the contact form feature of the plugin to insert and execute JavaScript code as an admin of your site. Needless to say, that&hellip;","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2098,12,15],"tags":[],"class_list":["post-8276","post","type-post","status-publish","format-standard","hentry","category-hosting-insights","category-security","category-wordpress"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v24.2 (Yoast SEO v24.2) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>JetPack XSS Security Issue - What We Did to Protect You : SiteGround Blog<\/title>\n<meta name=\"description\" content=\"On October 1st, a security issue in JetPack, one of the most commonly used WordPress plugins, was disclosed by our partners from Sucuri. The vulnerability\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/newblog.siteground.com\/en\/jetpack-xss-security-issue\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"JetPack XSS Security Issue - What We Did to Protect You\" \/>\n<meta property=\"og:description\" content=\"On October 1st, a security issue in JetPack, one of the most commonly used WordPress plugins, was disclosed by our partners from Sucuri. The vulnerability\" \/>\n<meta property=\"og:url\" content=\"https:\/\/newblog.siteground.com\/en\/jetpack-xss-security-issue\/\" \/>\n<meta property=\"og:site_name\" content=\"SiteGround\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/siteground\" \/>\n<meta property=\"article:published_time\" content=\"2015-10-07T15:00:03+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-09-18T14:49:06+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/newblog.siteground.com\/en\/wp-content\/uploads\/sites\/2\/2016\/10\/jetpack.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"660\" \/>\n\t<meta property=\"og:image:height\" content=\"200\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Hristo Pandjarov\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@siteground\" \/>\n<meta name=\"twitter:site\" content=\"@siteground\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Hristo Pandjarov\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/newblog.siteground.com\/en\/jetpack-xss-security-issue\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/newblog.siteground.com\/en\/jetpack-xss-security-issue\/\"},\"author\":{\"name\":\"Hristo Pandjarov\",\"@id\":\"https:\/\/newblog.siteground.com\/en\/#\/schema\/person\/ac3e1be52d672a8747613b4fa6808390\"},\"headline\":\"JetPack XSS Security Issue &#8211; What We Did to Protect You\",\"datePublished\":\"2015-10-07T15:00:03+00:00\",\"dateModified\":\"2025-09-18T14:49:06+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/newblog.siteground.com\/en\/jetpack-xss-security-issue\/\"},\"wordCount\":313,\"commentCount\":5,\"publisher\":{\"@id\":\"https:\/\/newblog.siteground.com\/en\/#organization\"},\"image\":{\"@id\":\"https:\/\/newblog.siteground.com\/en\/jetpack-xss-security-issue\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/newblog.siteground.com\/en\/wp-content\/uploads\/sites\/2\/2016\/10\/jetpack.jpg\",\"articleSection\":[\"Hosting Insights\",\"Security\",\"WordPress\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/newblog.siteground.com\/en\/jetpack-xss-security-issue\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/newblog.siteground.com\/en\/jetpack-xss-security-issue\/\",\"url\":\"https:\/\/newblog.siteground.com\/en\/jetpack-xss-security-issue\/\",\"name\":\"JetPack XSS Security Issue - What We Did to Protect You : SiteGround Blog\",\"isPartOf\":{\"@id\":\"https:\/\/newblog.siteground.com\/en\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/newblog.siteground.com\/en\/jetpack-xss-security-issue\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/newblog.siteground.com\/en\/jetpack-xss-security-issue\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/newblog.siteground.com\/en\/wp-content\/uploads\/sites\/2\/2016\/10\/jetpack.jpg\",\"datePublished\":\"2015-10-07T15:00:03+00:00\",\"dateModified\":\"2025-09-18T14:49:06+00:00\",\"description\":\"On October 1st, a security issue in JetPack, one of the most commonly used WordPress plugins, was disclosed by our partners from Sucuri. The vulnerability\",\"breadcrumb\":{\"@id\":\"https:\/\/newblog.siteground.com\/en\/jetpack-xss-security-issue\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/newblog.siteground.com\/en\/jetpack-xss-security-issue\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/newblog.siteground.com\/en\/jetpack-xss-security-issue\/#primaryimage\",\"url\":\"https:\/\/newblog.siteground.com\/en\/wp-content\/uploads\/sites\/2\/2016\/10\/jetpack.jpg\",\"contentUrl\":\"https:\/\/newblog.siteground.com\/en\/wp-content\/uploads\/sites\/2\/2016\/10\/jetpack.jpg\",\"width\":660,\"height\":200},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/newblog.siteground.com\/en\/jetpack-xss-security-issue\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/newblog.siteground.com\/en\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"JetPack XSS Security Issue &#8211; What We Did to Protect You\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/newblog.siteground.com\/en\/#website\",\"url\":\"https:\/\/newblog.siteground.com\/en\/\",\"name\":\"SiteGround Blog\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/newblog.siteground.com\/en\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/newblog.siteground.com\/en\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/newblog.siteground.com\/en\/#organization\",\"name\":\"SiteGround Blog\",\"url\":\"https:\/\/newblog.siteground.com\/en\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/newblog.siteground.com\/en\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/newblog.siteground.com\/en\/wp-content\/uploads\/sites\/2\/2025\/01\/Siteground-Logo-on-white.jpg\",\"contentUrl\":\"https:\/\/newblog.siteground.com\/en\/wp-content\/uploads\/sites\/2\/2025\/01\/Siteground-Logo-on-white.jpg\",\"width\":1200,\"height\":400,\"caption\":\"SiteGround Blog\"},\"image\":{\"@id\":\"https:\/\/newblog.siteground.com\/en\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/siteground\",\"https:\/\/x.com\/siteground\",\"https:\/\/www.instagram.com\/siteground\/\",\"https:\/\/www.youtube.com\/@siteground\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/newblog.siteground.com\/en\/#\/schema\/person\/ac3e1be52d672a8747613b4fa6808390\",\"name\":\"Hristo Pandjarov\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/newblog.siteground.com\/en\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/e7d38ccbb1776eaf1c34c8453bdc6de1?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/e7d38ccbb1776eaf1c34c8453bdc6de1?s=96&d=mm&r=g\",\"caption\":\"Hristo Pandjarov\"},\"sameAs\":[\"https:\/\/www.linkedin.com\/in\/hristo-pandjarov-05194841\/\"],\"url\":\"https:\/\/newblog.siteground.com\/en\/author\/hristo\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"JetPack XSS Security Issue - What We Did to Protect You : SiteGround Blog","description":"On October 1st, a security issue in JetPack, one of the most commonly used WordPress plugins, was disclosed by our partners from Sucuri. The vulnerability","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/newblog.siteground.com\/en\/jetpack-xss-security-issue\/","og_locale":"en_US","og_type":"article","og_title":"JetPack XSS Security Issue - What We Did to Protect You","og_description":"On October 1st, a security issue in JetPack, one of the most commonly used WordPress plugins, was disclosed by our partners from Sucuri. The vulnerability","og_url":"https:\/\/newblog.siteground.com\/en\/jetpack-xss-security-issue\/","og_site_name":"SiteGround","article_publisher":"https:\/\/www.facebook.com\/siteground","article_published_time":"2015-10-07T15:00:03+00:00","article_modified_time":"2025-09-18T14:49:06+00:00","og_image":[{"width":660,"height":200,"url":"https:\/\/newblog.siteground.com\/en\/wp-content\/uploads\/sites\/2\/2016\/10\/jetpack.jpg","type":"image\/jpeg"}],"author":"Hristo Pandjarov","twitter_card":"summary_large_image","twitter_creator":"@siteground","twitter_site":"@siteground","twitter_misc":{"Written by":"Hristo Pandjarov","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/newblog.siteground.com\/en\/jetpack-xss-security-issue\/#article","isPartOf":{"@id":"https:\/\/newblog.siteground.com\/en\/jetpack-xss-security-issue\/"},"author":{"name":"Hristo Pandjarov","@id":"https:\/\/newblog.siteground.com\/en\/#\/schema\/person\/ac3e1be52d672a8747613b4fa6808390"},"headline":"JetPack XSS Security Issue &#8211; What We Did to Protect You","datePublished":"2015-10-07T15:00:03+00:00","dateModified":"2025-09-18T14:49:06+00:00","mainEntityOfPage":{"@id":"https:\/\/newblog.siteground.com\/en\/jetpack-xss-security-issue\/"},"wordCount":313,"commentCount":5,"publisher":{"@id":"https:\/\/newblog.siteground.com\/en\/#organization"},"image":{"@id":"https:\/\/newblog.siteground.com\/en\/jetpack-xss-security-issue\/#primaryimage"},"thumbnailUrl":"https:\/\/newblog.siteground.com\/en\/wp-content\/uploads\/sites\/2\/2016\/10\/jetpack.jpg","articleSection":["Hosting Insights","Security","WordPress"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/newblog.siteground.com\/en\/jetpack-xss-security-issue\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/newblog.siteground.com\/en\/jetpack-xss-security-issue\/","url":"https:\/\/newblog.siteground.com\/en\/jetpack-xss-security-issue\/","name":"JetPack XSS Security Issue - What We Did to Protect You : SiteGround Blog","isPartOf":{"@id":"https:\/\/newblog.siteground.com\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/newblog.siteground.com\/en\/jetpack-xss-security-issue\/#primaryimage"},"image":{"@id":"https:\/\/newblog.siteground.com\/en\/jetpack-xss-security-issue\/#primaryimage"},"thumbnailUrl":"https:\/\/newblog.siteground.com\/en\/wp-content\/uploads\/sites\/2\/2016\/10\/jetpack.jpg","datePublished":"2015-10-07T15:00:03+00:00","dateModified":"2025-09-18T14:49:06+00:00","description":"On October 1st, a security issue in JetPack, one of the most commonly used WordPress plugins, was disclosed by our partners from Sucuri. The vulnerability","breadcrumb":{"@id":"https:\/\/newblog.siteground.com\/en\/jetpack-xss-security-issue\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/newblog.siteground.com\/en\/jetpack-xss-security-issue\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/newblog.siteground.com\/en\/jetpack-xss-security-issue\/#primaryimage","url":"https:\/\/newblog.siteground.com\/en\/wp-content\/uploads\/sites\/2\/2016\/10\/jetpack.jpg","contentUrl":"https:\/\/newblog.siteground.com\/en\/wp-content\/uploads\/sites\/2\/2016\/10\/jetpack.jpg","width":660,"height":200},{"@type":"BreadcrumbList","@id":"https:\/\/newblog.siteground.com\/en\/jetpack-xss-security-issue\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/newblog.siteground.com\/en\/"},{"@type":"ListItem","position":2,"name":"JetPack XSS Security Issue &#8211; What We Did to Protect You"}]},{"@type":"WebSite","@id":"https:\/\/newblog.siteground.com\/en\/#website","url":"https:\/\/newblog.siteground.com\/en\/","name":"SiteGround Blog","description":"","publisher":{"@id":"https:\/\/newblog.siteground.com\/en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/newblog.siteground.com\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/newblog.siteground.com\/en\/#organization","name":"SiteGround Blog","url":"https:\/\/newblog.siteground.com\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/newblog.siteground.com\/en\/#\/schema\/logo\/image\/","url":"https:\/\/newblog.siteground.com\/en\/wp-content\/uploads\/sites\/2\/2025\/01\/Siteground-Logo-on-white.jpg","contentUrl":"https:\/\/newblog.siteground.com\/en\/wp-content\/uploads\/sites\/2\/2025\/01\/Siteground-Logo-on-white.jpg","width":1200,"height":400,"caption":"SiteGround Blog"},"image":{"@id":"https:\/\/newblog.siteground.com\/en\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/siteground","https:\/\/x.com\/siteground","https:\/\/www.instagram.com\/siteground\/","https:\/\/www.youtube.com\/@siteground"]},{"@type":"Person","@id":"https:\/\/newblog.siteground.com\/en\/#\/schema\/person\/ac3e1be52d672a8747613b4fa6808390","name":"Hristo Pandjarov","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/newblog.siteground.com\/en\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/e7d38ccbb1776eaf1c34c8453bdc6de1?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/e7d38ccbb1776eaf1c34c8453bdc6de1?s=96&d=mm&r=g","caption":"Hristo Pandjarov"},"sameAs":["https:\/\/www.linkedin.com\/in\/hristo-pandjarov-05194841\/"],"url":"https:\/\/newblog.siteground.com\/en\/author\/hristo\/"}]}},"_links":{"self":[{"href":"https:\/\/newblog.siteground.com\/en\/wp-json\/wp\/v2\/posts\/8276","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/newblog.siteground.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/newblog.siteground.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/newblog.siteground.com\/en\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/newblog.siteground.com\/en\/wp-json\/wp\/v2\/comments?post=8276"}],"version-history":[{"count":14,"href":"https:\/\/newblog.siteground.com\/en\/wp-json\/wp\/v2\/posts\/8276\/revisions"}],"predecessor-version":[{"id":21028,"href":"https:\/\/newblog.siteground.com\/en\/wp-json\/wp\/v2\/posts\/8276\/revisions\/21028"}],"wp:attachment":[{"href":"https:\/\/newblog.siteground.com\/en\/wp-json\/wp\/v2\/media?parent=8276"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/newblog.siteground.com\/en\/wp-json\/wp\/v2\/categories?post=8276"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/newblog.siteground.com\/en\/wp-json\/wp\/v2\/tags?post=8276"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}