Automattic Jetpack vulnerabilities

• automattic jetpack videopress WordPress Jetpack VideoPress plugin <= 3.6 - Broken Access Control vulnerability CVE-2026-40808 6.5 MediumOctober 10, 2026
• automattic jetpack WordPress Jetpack plugin <= 16.2 - Broken Authentication vulnerability CVE-2026-106602 4.8 MediumOctober 9, 2026
• automattic jetpack WordPress Jetpack plugin <= 16.2 - Broken Authentication vulnerability CVE-2026-106601 5.4 MediumOctober 9, 2026
• automattic jetpack crm WordPress Jetpack CRM plugin <= 6.7.0 - Local File Inclusion vulnerability CVE-2026-22356 Public exploit 7.5 HighFebruary 20, 2026
• automattic jetpack Jetpack 11.4 - Cross Site Scripting (XSS) CVE-2023-54332 5.1 MediumJanuary 13, 2026
• automattic jetpack boost Jetpack Boost < 3.4.7 - Admin+ SSRF CVE-2024-6584 9.1 CriticalMay 15, 2025
• automattic jetpack, jetpack boost +1 more Jetpack < 13.8, Boost < 3.4.8 - Contributor+ Stored XSS CVE-2024-10076 5.9 MediumMay 15, 2025
• automattic jetpack Jetpack < 13.8 - Unauthenticated Arbitrary Block & Shortcode Execution CVE-2024-10075 5.6 MediumMay 15, 2025
• automattic jetpack debug tools WordPress Jetpack Debug Tools plugin < 2.0.1 - Broken Access Control vulnerability CVE-2024-56006 5.3 MediumMay 15, 2025
• automattic jetpack Jetpack 13.0-14.0 - Unauthenticated DOM-XSS CVE-2024-10858 Public exploit 6.1 MediumDecember 25, 2024
• automattic jetpack Jetpack < 13.9.1 - Subscriber+ Arbitrary Feedback Access CVE-2024-9926 Public exploit 4.3 MediumNovember 7, 2024
• automattic jetpack WordPress Jetpack plugin < 12.7 - Contributor+ Broken Access Control vulnerability CVE-2023-47788 4.3 MediumJune 19, 2024
• automattic jetpack, jetpack – wp security, backup, speed, & growth +1 more Jetpack – WP Security, Backup, Speed, & Growth <= 13.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpvideo Shortcode CVE-2024-4392 6.4 MediumMay 14, 2024
• automattic jetpack WordPress Jetpack plugin < 12.7 - Auth. Iframe Injection vulnerability CVE-2023-47774 5.4 MediumApril 24, 2024
• automattic jetpack, jetpack – wp security, backup, speed, & growth +1 more WordPress Jetpack Plugin <= 12.8-a.1 is vulnerable to Cross Site Scripting (XSS) CVE-2023-45050 6.5 MediumNovember 30, 2023
• automattic jetpack crm, jetpack crm – clients, leads, invoices, billing, email marketing, & automation +1 more Jetpack CRM <= 5.3.1 - Cross-Site Request Forgery and PHAR Deserialization CVE-2022-3342 7.5 HighOctober 20, 2023
• automattic jetpack Jetpack < 12.1.1 - Author+ Arbitrary File Manipulation via API CVE-2023-2996 8.8 HighJune 27, 2023
• automattic jetpack crm WordPress Jetpack CRM Plugin <= 5.4.4 is vulnerable to Cross Site Scripting (XSS) CVE-2023-27429 5.9 MediumJune 21, 2023
• automattic jetpack crm Jetpack CRM < 5.5 - Contributor+ Stored XSS CVE-2022-4497 5.4 MediumJanuary 9, 2023
• automattic jetpack crm Jetpack CRM < 5.4.3 - Admin+ Cross-Site Scripting CVE-2022-3919 4.8 MediumDecember 12, 2022
• automattic jetpack, jetpack – wp security, backup, speed, & growth +1 more Jetpack < 9.8 - Carousel Module Non-Published Page/Post Attachment Comment Leak CVE-2021-24374 Fix available 5.3 MediumJune 21, 2021
• automattic jetpack The Jetpack plugin before 3.4.3 for WordPress has XSS via add_query_arg() and remove_query_arg(). CVE-2015-9359 6.1 MediumAugust 28, 2019
• automattic jetpack The Jetpack plugin before 4.0.3 for WordPress has XSS via a crafted Vimeo link. CVE-2016-10706 6.1 MediumJanuary 12, 2018
• automattic jetpack The Jetpack plugin before 4.0.4 for WordPress has XSS via the Likes module. CVE-2016-10705 6.1 MediumJanuary 12, 2018
• automattic jetpack The Jetpack plugin before 1.9 before 1.9.4, 2.0.x before 2.0.9, 2.1.x before 2.1.4, 2.2.x before... CVE-2014-0173 5.8 MediumApril 21, 2014
• automattic jetpack SQL injection vulnerability in modules/sharedaddy.php in the Jetpack plugin for WordPress allows... CVE-2011-4673 Public exploit 7.5 HighDecember 2, 2011