An attacker can cause a victim’s browser to execute arbitrary JavaScript by exploiting a reflected XSS flaw in the Jetpack 9.1 plugin. The vulnerability is triggered when an attacker supplies a crafted value for the post_id parameter on the grunion‑form‑view.php endpoint, causing the script payload to be reflected unescaped in the response. If executed, the malicious code runs in the victim’s context and could lead to credential theft, session hijacking or the ability to perform further attacks on the host system.

The issue is present in the WordPress Jetpack plugin released as version 9.1, distributed by Automattic. Related CPE entries for jetpack_boost 9.1 are also affected. No other versions or products are listed as impacted.

The vulnerability receives a CVSS score of 5.1, indicating medium severity, and EPSS data is unavailable. The flaw is not listed in the CISA KEV catalog. The most likely attack path is the delivery of a malicious URL to a user, which can be accomplished over the public web with no special network access. Exploitation is straightforward for anyone able to navigate a legitimate site that hosts the vulnerable plugin.