Skip to contentAutomattic vulnerabilities
Newest
- automattic crowdsignal dashboard, automattic, inc. crowdsignal dashboard – polls, surveys & more +1 moreWordPress Crowdsignal Dashboard – Polls, Surveys & more Plugin <= 3.0.11 is vulnerable to Cross Site Scripting (XSS)CVE-2023-514887.1 High
- automattic woocommerceWooCommerce < 6.2.1 - Subscriber+ Arbitrary Comment DeletionCVE-2022-07754.3 Medium
- automattic woocommerceWordPress WooCommerce Plugin <= 8.2.2 is vulnerable to Cross Site Request Forgery (CSRF)CVE-2023-522224.3 Medium
- automattic woocommerce stripe, woocommerce stripe payment gateway +1 moreWordPress WooCommerce Stripe Payment Gateway Plugin <= 7.6.1 is vulnerable to Insecure Direct Object References (IDOR)CVE-2023-515027.5 High
- automattic woopayments, woopayments – fully integrated solution built and supported by woo +1 moreWordPress WooCommerce Payments Plugin <= 6.6.2 is vulnerable to Insecure Direct Object References (IDOR)CVE-2023-515035.9 Medium
- automattic wordpress.com editing toolkitWordPress WordPress.com Editing Toolkit Plugin <= 3.78784 is vulnerable to Cross Site Scripting (XSS)CVE-2023-508796.5 Medium
- automattic woocommerce bookings, woocommerce bookings +1 moreWordPress WooCommerce Bookings Plugin <= 1.15.78 is vulnerable to Insecure Direct Object References (IDOR)CVE-2023-327475.4 Medium
- automattic woocommerce subscriptions, woocommerce woo subscriptions +1 moreWordPress WooCommerce Subscriptions Plugin <= 5.1.2 is vulnerable to Insecure Direct Object References (IDOR)CVE-2023-359147.5 High
- automattic woopayments, woopayments – fully integrated solution built and supported by woo +1 moreWordPress WooCommerce Payments Plugin <= 5.9.0 is vulnerable to SQL InjectionCVE-2023-359157.6 High
- automattic woopayments, woopayments – fully integrated solution built and supported by woo +1 moreWordPress WooCommerce Payments Plugin <= 5.9.0 is vulnerable to Insecure Direct Object References (IDOR)CVE-2023-359167.5 High
- automattic woocommerce square, woocommerce square +1 moreWordPress WooCommerce Square Plugin <= 3.8.1 is vulnerable to Insecure Direct Object References (IDOR)CVE-2023-358768.1 High
- automattic woocommerce gocardless, woocommerce gocardless +1 moreWordPress WooCommerce GoCardless Gateway Plugin <= 2.5.6 is vulnerable to Insecure Direct Object References (IDOR)CVE-2023-378718.2 High
- automattic canada post shipping methodWordPress WooCommerce Canada Post Shipping Plugin <= 2.8.3 is vulnerable to Cross Site Request Forgery (CSRF)CVE-2023-477894.3 Medium
- automattic woocommerce bookings, woocommerce bookings +1 moreWordPress WooCommerce Bookings Plugin <= 2.0.3 is vulnerable to Cross Site Request Forgery (CSRF)CVE-2023-477874.3 Medium
- automattic woopayments, woopayments – fully integrated solution built and supported by woo +1 moreWordPress WooCommerce Payments Plugin <= 6.4.2 is vulnerable to Cross Site Scripting (XSS)CVE-2023-498286.5 Medium
- automattic jetpack, jetpack – wp security, backup, speed, & growth +1 moreWordPress Jetpack Plugin <= 12.8-a.1 is vulnerable to Cross Site Scripting (XSS)CVE-2023-450506.5 Medium
- automattic woocommerce, woocommerce blocks +1 moreWordPress WooCommerce and WooCommerce Blocks plugins - Auth. Cross-Site Scripting (XSS) vulnerabilityCVE-2023-477776.5 Medium
- automattic jetpack crm, jetpack crm – clients, leads, invoices, billing, email marketing, & automation +1 moreJetpack CRM <= 5.3.1 - Cross-Site Request Forgery and PHAR DeserializationCVE-2022-33427.5 High
- automattic activitypubActivityPub for WordPress < 1.0.0 - Subscriber+ Arbitrary Post Title DisclosureCVE-2023-37064.3 Medium
- automattic activitypubActivityPub for WordPress < 1.0.1 - Contributor+ Stored XSSCVE-2023-37465.4 Medium
- automattic activitypubActivityPub for WordPress < 1.0.0 - Contributor+ Stored XSSCVE-2023-50575.4 Medium
- automattic activitypubActivityPub for WordPress < 1.0.0 - Subscriber+ Arbitrary Post Content DisclosureCVE-2023-37074.3 Medium
- automattic mongooseCesanta Mongoose MQTT Message Parsing Heap OverflowCVE-2023-2905Fix available8.8 High
- automattic automattic/mongoose, mongoosejs mongoose +1 morePrototype Pollution in automattic/mongooseCVE-2023-3696Fix available10.0 Critical
- automattic jetpackJetpack < 12.1.1 - Author+ Arbitrary File Manipulation via APICVE-2023-29968.8 High
- automattic jetpack crmWordPress Jetpack CRM Plugin <= 5.4.4 is vulnerable to Cross Site Scripting (XSS)CVE-2023-274295.9 Medium
- automattic vaultpress, unspecified vaultpress plugin +1 moreVaultPress Plugin MailPoet Plugin class.vaultpress-hotfixes.php protect_aioseo_ajax unrestricted uploadCVE-2014-1251046.3 Medium
- automattic limit login attempts, limit login attempts project login attempts +1 moreLimit Login Attempts < 1.7.2 - Subscriber+ Stored XSSCVE-2023-1861EPSS 28.8%5.4 Medium
- automattic woocommerce payments, woopayments +1 moreAn issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an...CVE-2023-28121Public exploitEPSS 87.4%9.8 Critical
- automattic limit login attempts, limit login attempts project login attempts +1 moreLimit Login Attempts <= 1.7.1 - Unauthenticated Stored Cross-Site ScriptingCVE-2023-19127.2 High
- automattic jetpack crmJetpack CRM < 5.5 - Contributor+ Stored XSSCVE-2022-44975.4 Medium
- automattic jetpack crmJetpack CRM < 5.4.3 - Admin+ Cross-Site ScriptingCVE-2022-39194.8 Medium
- automattic crowdsignal dashboard, automattic, inc. crowdsignal dashboard – polls, surveys & more (wordpress plugin) +1 moreWordPress Crowdsignal Dashboard plugin <= 3.0.9 - Privilege Escalation vulnerabilityCVE-2022-450696.3 Medium
- automattic sensei lms, sensei lms – online courses, quizzes, & learning +1 moreSensei LMS < 4.5.2 - Arbitrary Private Message Sending via IDORCVE-2022-20804.3 Medium
- automattic sensei lmsSensei LMS < 4.5.0 - Unauthenticated Private Messages Disclosure via Rest APICVE-2022-20345.3 Medium
- automattic crowdsignal dashboard, automattic, inc. crowdsignal dashboard – polls, surveys & more +1 moreCrowdsignal Polls & Ratings < 3.0.8 - Reflected Cross-Site ScriptingCVE-2022-23866.1 Medium
- automattic automattic/mongoose, mongoosejs mongoose +1 morePrototype Pollution in automattic/mongooseCVE-2022-2564Fix availableEPSS 31.3%7.0 High
- automattic woocommerceWooCommerce < 6.6.0 - Admin+ Stored HTML InjectionCVE-2022-2099Fix available4.8 Medium
- automattic limit login attemptsLimit Login Attempts < 4.0.72 - Admin+ Stored Cross-Site ScriptingCVE-2022-10294.8 Medium
- automattic vaultpress, unspecified vaultpress plugin +1 moreVaultPress Plugin code injectionCVE-2017-200866.3 Medium
- automattic limit login attempts, limit login attempts project login attempts +1 moreLimit Login Attempts < 4.0.50 - Unauthenticated Stored Cross-Site ScriptingCVE-2021-246576.1 Medium
- automattic woocommerceBlind SQL Injection possible via Authenticated Web-hook Search API EndpointCVE-2021-327904.9 Medium
- automattic woocommerce blocks, woocommerce woocommerce-gutenberg-products-block +1 moreArbitrary SQL (SQL injection) possible via the Store API component.CVE-2021-32789Public exploitEPSS 17.2%7.5 High
- automattic jetpack, jetpack – wp security, backup, speed, & growth +1 moreJetpack < 9.8 - Carousel Module Non-Published Page/Post Attachment Comment LeakCVE-2021-24374Fix available5.3 Medium
- automattic wp super cacheWP Super Cache < 1.7.3 - Authenticated Stored Cross-Site Scripting (XSS)CVE-2021-243295.4 Medium
- automattic wp super cacheWP Super Cache < 1.7.3 - Authenticated Remote Code ExecutionCVE-2021-243127.2 High
- automattic woocommerceWoocommerce < 5.2.0 - Authenticated Stored Cross-Site Scripting (XSS)CVE-2021-24323Fix available4.8 Medium
- automattic wp super cacheWP Super Cache < 1.7.2 - Authenticated Remote Code Execution (RCE)CVE-2021-24209EPSS 27.7%7.2 High
- automattic canvasBuffer overflow in canvasCVE-2020-8215Fix available8.8 High
- automattic mailpoetThe MailPoet plugin before 3.23.2 for WordPress allows remote attackers to inject arbitrary web...CVE-2019-118436.1 Medium
- Show moreLoading…