Automattic vulnerabilities

Products

• Mongoose 36
• Woocommerce 24
• Jetpack 18
• Sensei Lms 7
• Activitypub 6
• Wp Super Cache 6
• Limit Login Attempts 5
• Woopayments 5
• Crowdsignal Dashboard 4
• Jetpack Crm 4
• Newspack Blocks 4
• Sensei Lms 4
• Woopayments – Fully Integrated Solution Built And Supported By Woo 4
• Wordpress 4
• Wp Job Manager 4
• Jetpack – Wp Security, Backup, Speed, & Growth 3
• Mailpoet 3
• Newspack Newsletters 3
• Newspack Newsletters 3
• Automattic/mongoose 2
• Camptix Event Ticketing 2
• Jetpack Boost 2
• Sensei Lms – Online Courses, Quizzes, & Learning 2
• Sensei Pro (wc Paid Courses) 2
• Vaultpress 2
• Woocommerce Blocks 2
• Woocommerce Bookings 2
• Wp Job Manager 2
• Wp Job Manager - Resume Manager 2

Newest

• automattic mongoose Mongoose: Heap OOB reads and null-byte bypass in mg_path_is_sane (util.c) CVE-2026-115473 Fix available 6.5 MediumNovember 4, 2026
• automattic sensei lms Sensei LMS 4.26.4 Broken Access Control via save_new_message CVE-2026-112329 5.3 MediumOctober 19, 2026
• automattic sensei lms Sensei LMS 4.26.4 Broken Access Control via add_new_module_term AJAX CVE-2026-112328 5.3 MediumOctober 19, 2026
• automattic mongoose Mongoose: ppp_handle_ipv6cp() uses attacker-controlled length without bounds check — OOB read and heap overflow (PPP/PPPoE, MG_ENABLE_IPV6) CVE-2026-63626 Fix available 8.8 HighOctober 14, 2026
• automattic mongoose Mongoose: handle_opt() missing opts[1] > len check — 1-byte OOB read corrupts TCP MSS, silences mg_send() per connection CVE-2026-73261 Fix available 7.5 HighOctober 14, 2026
• automattic mongoose Mongoose: Out-of-bounds Read via length-counter underflow in built-in TLS X.509 DER parser CVE-2026-73260 Fix available 7.5 HighOctober 14, 2026
• automattic mongoose Mongoose: Unauthenticated remote heap out-of-bounds read in built-in TLS: off-by-one length check in mg_tls_recv_record() underflows recv_len to SIZE_MAX CVE-2026-73252 Fix available 7.5 HighOctober 14, 2026
• automattic jetpack videopress WordPress Jetpack VideoPress plugin <= 3.6 - Broken Access Control vulnerability CVE-2026-40808 6.5 MediumOctober 10, 2026
• automattic woocommerce WordPress WooCommerce plugin 9.8.0-11.1.2 - Shop Manager+ Privilege Escalation vulnerability CVE-2026-106608 7.2 HighOctober 10, 2026
• automattic jetpack WordPress Jetpack plugin <= 16.2 - Broken Authentication vulnerability CVE-2026-106602 4.8 MediumOctober 9, 2026
• automattic jetpack WordPress Jetpack plugin <= 16.2 - Broken Authentication vulnerability CVE-2026-106601 5.4 MediumOctober 9, 2026
• automattic wordpress WordPress Core <= 7.1.2 - Unauthenticated Sensitive Data Exposure of Comments on Private and Unpublished Posts via Comment Feed vulnerability CVE-2026-66666 Fix available 6.9 MediumOctober 6, 2026
• automattic mongoose Cesanta Mongoose MQTT Broker main.c fn stack-based overflow CVE-2026-101003 Fix available 6.9 MediumSeptember 28, 2026
• automattic wordpress WordPress Core <= 7.1 - Cross Site Scripting (XSS) vulnerability CVE-2026-93485 Public exploitFix available 7.1 HighSeptember 18, 2026
• automattic woocommerce WordPress WooCommerce plugin < 11.1.0 - Denial of Service Attack vulnerability CVE-2026-48888 7.5 HighSeptember 8, 2026
• automattic woocommerce WordPress WooCommerce plugin < 11.0 - SQL Injection vulnerability CVE-2026-57777 7.6 HighSeptember 4, 2026
• automattic mongoose Mongoose: TLS Hostname Verification Bypass via Overly Permissive Wildcard Matching CVE-2026-73253 Fix available 9.1 CriticalAugust 20, 2026
• automattic mongoose Mongoose: Path traversal in SSI #include directives enables arbitrary file read CVE-2026-73255 Fix available 6.5 MediumAugust 20, 2026
• automattic mongoose Mongoose: Reflected XSS via decoded URI in directory listing render CVE-2026-73259 Fix available 5.4 MediumAugust 20, 2026
• automattic mongoose Mongoose: HTTP/1.0 detection off-by-one enables request smuggling via chunked TE CVE-2026-73256 Fix available 9.1 CriticalAugust 20, 2026
• automattic mongoose Mongoose: Stored XSS via unescaped filenames in directory listing CVE-2026-73254 Fix available 5.4 MediumAugust 20, 2026
• automattic mongoose Mongoose: Multipart boundary/header scan logic error in mg_http_next_multipart CVE-2026-73258 Fix available 6.5 MediumAugust 20, 2026
• automattic mongoose Mongoose Built-in TLS: CA-bundle certificate chain accepted without any signature verification CVE-2026-73251 Fix available 9.3 CriticalAugust 20, 2026
• automattic mongoose Mongoose: Content-Length + Transfer-Encoding coexistence enables request smuggling CVE-2026-73257 Fix available 9.1 CriticalAugust 20, 2026
• automattic mongoose Mongoose: Prototype pollution in the update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter) CVE-2026-73562 Fix available 6.5 MediumJuly 24, 2026
• automattic mongoose Cesanta Mongoose Out-of-Bounds Read in MG_TLS_BUILTIN ClientHello Session ID Parsing CVE-2026-11404 Fix available 8.7 HighJuly 9, 2026
• automattic woocommerce WooCommerce 7.1.0 Remote Code Execution via class-wc-meta-box-product-images.php CVE-2022-50972 9.3 CriticalJune 20, 2026
• automattic mongoose Mongoose: Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection CVE-2026-42334 Fix available 7.5 HighMay 5, 2026
• automattic mongoose Cesanta Mongoose GCM Authentication Tag tls_aes128.c mg_aes_gcm_decrypt signature verification CVE-2026-6986 Fix available 6.3 MediumApril 25, 2026
• automattic mongoose Cesanta Mongoose TCP Option net_builtin.c handle_opt infinite loop CVE-2026-6985 Fix available 6.9 MediumApril 25, 2026
• automattic activitypub ActivityPub Routing < 8.0.2 - Unauthenticated Drafts/Scheduled/Pending Posts Disclosure CVE-2026-4338 7.5 HighApril 8, 2026
• automattic mongoose Cesanta Mongoose P-384 Public Key mongoose.c mg_tls_verify_cert_signature authorization CVE-2026-5246 Fix available 6.3 MediumApril 2, 2026
• automattic mongoose Cesanta Mongoose mDNS Record mongoose.c handle_mdns_record stack-based overflow CVE-2026-5245 Fix available 6.3 MediumApril 2, 2026
• automattic mongoose Cesanta Mongoose TLS 1.3 mongoose.c mg_tls_recv_cert heap-based overflow CVE-2026-5244 Fix available 6.9 MediumApril 2, 2026
• automattic woocommerce WooCommerce < 10.5.3 - Arbitrary Admin User Creation via CSRF CVE-2026-3589 7.5 HighMarch 6, 2026
• automattic mongoose Cesanta Mongoose Poly1305 Authentication Tag tls_chacha20.c mg_chacha20_poly1305_decrypt signature verification CVE-2026-2968 Fix available 6.3 MediumFebruary 23, 2026
• automattic mongoose Cesanta Mongoose TCP Sequence Number net_builtin.c getpeer verification of source CVE-2026-2967 Fix available 6.3 MediumFebruary 23, 2026
• automattic mongoose Cesanta Mongoose DNS Transaction ID dns.c mg_sendnsreq random values CVE-2026-2966 Fix available 6.3 MediumFebruary 23, 2026
• automattic jetpack crm WordPress Jetpack CRM plugin <= 6.7.0 - Local File Inclusion vulnerability CVE-2026-22356 Public exploit 7.5 HighFebruary 20, 2026
• automattic wp job manager WordPress WP Job Manager plugin <= 2.4.0 - Broken Access Control vulnerability CVE-2026-25404 5.3 MediumFebruary 19, 2026
• automattic jetpack Jetpack 11.4 - Cross Site Scripting (XSS) CVE-2023-54332 5.1 MediumJanuary 13, 2026
• automattic wp job manager WordPress WP Job Manager plugin <= 2.0.0 - Cross Site Request Forgery (CSRF) vulnerability CVE-2023-52212 5.4 MediumJanuary 5, 2026
• automattic crowdsignal forms WordPress Crowdsignal Forms plugin <= 1.7.2 - Broken Access Control vulnerability CVE-2025-69015 Public exploit 3.8 LowDecember 30, 2025
• automattic woocommerce WooCommerce - Subscriber/Customer+ Order Data Disclosure CVE-2025-15033 6.5 MediumDecember 22, 2025
• automattic woocommerce WooCommerce <= 7.8.2 - Sensitive Information Exposure CVE-2023-7320 5.3 MediumOctober 29, 2025
• automattic woocommerce WordPress WooCommerce plugin <= 10.0.2 - Cross Site Scripting (XSS) vulnerability CVE-2025-49042 5.9 MediumOctober 29, 2025
• automattic developer WordPress Developer Plugin <= 1.2.6 - Cross Site Request Forgery (CSRF) Vulnerability CVE-2025-57924 4.3 MediumSeptember 22, 2025
• automattic newspack newsletters WordPress Newspack Newsletters plugin <= 3.13.0 - Open Redirection Vulnerability CVE-2025-49325 4.7 MediumJune 6, 2025
• automattic woocommerce WooCommerce <= 9.4.2 - PostMessage-Based Cross-Site Scripting CVE-2025-5062 6.1 MediumMay 22, 2025
• automattic sensei lms Sensei LMS < 4.20.0 - Teacher+ Users Email Address Disclosure CVE-2024-8009 4.3 MediumMay 15, 2025
• Show olderLoading…