Skip to contentAutomattic vulnerabilities
Newest
- automattic jetpack boostJetpack Boost < 3.4.7 - Admin+ SSRFCVE-2024-65849.1 Critical
- automattic mailpoetMailPoet < 5.5.2 - Admin+ Stored XSSCVE-2024-127434.8 Medium
- automattic jetpack, jetpack boost +1 moreJetpack < 13.8, Boost < 3.4.8 - Contributor+ Stored XSSCVE-2024-100765.9 Medium
- automattic jetpackJetpack < 13.8 - Unauthenticated Arbitrary Block & Shortcode ExecutionCVE-2024-100755.6 Medium
- automattic toursWordPress Tours plugin <= 1.0.0 - Broken Access Control vulnerabilityCVE-2024-516664.3 Medium
- automattic jetpack debug toolsWordPress Jetpack Debug Tools plugin < 2.0.1 - Broken Access Control vulnerabilityCVE-2024-560065.3 Medium
- automattic sensei lmsWordPress Sensei LMS plugin <= 4.24.4 - Broken Access Control vulnerabilityCVE-2025-227405.3 Medium
- automattic woocommerceWordPress WooCommerce plugin <= 9.7.0 - Cross Site Scripting (XSS) vulnerabilityCVE-2025-267625.9 Medium
- automattic sensei lmsSensei LMS < 4.24.4 - Unauthenticated sensei_email/sensei_message DisclosureCVE-2025-04665.3 Medium
- automattic mongooseMongoose search injection vulnerabilityCVE-2025-23061Public exploitFix available9.0 Critical
- automattic wp job manager - resume managerWordPress WP Job Manager Resume Manager plugin <= 2.1.0 - Cross Site Request Forgery (CSRF) vulnerabilityCVE-2024-372414.3 Medium
- automattic newspack newslettersWordPress Newspack Newsletters plugin <= 2.13.2 - Cross Site Request Forgery (CSRF) vulnerabilityCVE-2024-372424.3 Medium
- automattic jetpackJetpack 13.0-14.0 - Unauthenticated DOM-XSSCVE-2024-10858Public exploit6.1 Medium
- automattic limit login attemptsWordPress Limit Login Attempts plugin <= 5.5 - SQL Injection vulnerabilityCVE-2024-542349.3 Critical
- automattic mongooseMongoose search injection vulnerabilityCVE-2024-53900Public exploitFix available9.1 Critical
- automattic crowdsignal dashboard – polls, surveys & moreWordPress Crowdsignal Polls & Ratings plugin <= 3.1.3 - Cross Site Request Forgery (CSRF) vulnerabilityCVE-2024-433384.3 Medium
- automattic mailpoetMailPoet < 5.3.2 - Admin+ Stored XSSCVE-2024-101036.1 Medium
- automattic google for woocommerce, woocommerce +1 moreGoogle for WooCommerce <= 2.8.6 - Information Disclosure via Publicly Accessible PHP Info FileCVE-2024-104865.3 Medium
- automattic jetpackJetpack < 13.9.1 - Subscriber+ Arbitrary Feedback AccessCVE-2024-9926Public exploit4.3 Medium
- automattic newspack blocksWordPress Newspack Blocks plugin <= 3.0.8 - Broken Access Control vulnerabilityCVE-2024-374255.4 Medium
- automattic newspack blocksWordPress Newspack Blocks plugin <= 3.0.8 - Contributor+ Arbitrary Directory Deletion vulnerabilityCVE-2024-374238.5 High
- automattic wp job manager - resume managerWordPress WP Job Manager plugin <= 2.1.0 - Broken Access Control vulnerabilityCVE-2024-374434.3 Medium
- automattic newspack newslettersWordPress Newspack Newsletters plugin <= 2.13.2 - Broken Access Control vulnerabilityCVE-2024-374755.3 Medium
- automattic newspack content converterWordPress Newspack Content Converter plugin <= 0.1.5 - Broken Access Control vulnerabilityCVE-2024-374776.5 Medium
- automattic newspackWordPress Newspack plugin < 3.8.7 - Broken Access Control vulnerabilityCVE-2024-439684.3 Medium
- automattic woocommerceWooCommerce <= 9.0.2 - Unauthenticated HTML InjectionCVE-2024-99445.3 Medium
- automattic sensei lmsSensei LMS < 4.24.2 - Unauthenticated Email Template LeakCVE-2024-77865.3 Medium
- automattic ghactivity, ghacitivity +1 moreWordPress GHActivity plugin <= 2.0.0-alpha - Cross Site Scripting (XSS) vulnerabilityCVE-2024-439496.5 Medium
- automattic sensei lms, sensei pro (wc paid courses), sensei pro +2 moreWordPress Sensei LMS plugin <= 4.23.1 - Broken Access Control vulnerabilityCVE-2024-356865.3 Medium
- automattic woocommerceWordPress WooCommerce plugin <= 9.1.2 - Cross Site Scripting (XSS) vulnerabilityCVE-2024-396665.9 Medium
- automattic newspack blocks, newspack newsletters +1 moreWordPress Newspack Blocks plugin <= 3.0.8 - Sensitive Data Exposure vulnerabilityCVE-2024-371157.5 High
- automattic newspack blocks, newspack newsletters +1 moreWordPress Newspack Blocks plugin <= 3.0.8 - Arbitrary File Upload vulnerabilityCVE-2024-374249.9 Critical
- automattic woocommerceWordPress WooCommerce plugin <= 8.9.2 - Content Injection vulnerabilityCVE-2024-357773.5 Low
- automattic newspack adsWordPress Newspack Ads plugin <= 1.47.1 - Cross Site Scripting (XSS) vulnerabilityCVE-2024-374746.5 Medium
- automattic newspack campaigns, newspack popups +1 moreWordPress Newspack Campaigns plugin <= 2.31.1 - Cross Site Scripting (XSS) vulnerabilityCVE-2024-374766.5 Medium
- automattic wordpressWordPress core < 6.5.5 - Auth. Arbitrary .html File Read (Windows Only) vulnerabilityCVE-2024-32111Fix available5.0 Medium
- automattic wordpressWordPress Core < 6.5.5 - Cross Site Scripting (XSS) vulnerabilityCVE-2024-31111Fix available6.5 Medium
- automattic jetpackWordPress Jetpack plugin < 12.7 - Contributor+ Broken Access Control vulnerabilityCVE-2023-477884.3 Medium
- automattic woocommerceWooCommerce has a Cross-Site Scripting Vulnerability in checkout & registration formsCVE-2024-37297Fix available5.4 Medium
- automattic activitypubWordPress ActivityPub plugin <= 1.0.5 - Unauthenticated Broken Access Control vulnerabilityCVE-2023-521996.5 Medium
- automattic sensei pro (wc paid courses), sensei pro (wc paid courses) +1 moreWordPress Sensei Pro (WC Paid Courses) plugin <= 4.23.1.1.23.1 - Cross Site Scripting (XSS) vulnerabilityCVE-2024-347656.5 Medium
- automattic chaostheoryWordPress ChaosTheory theme <= 1.3 - Cross Site Scripting (XSS) vulnerabilityCVE-2024-347666.5 Medium
- automattic jetpack, jetpack – wp security, backup, speed, & growth +1 moreJetpack – WP Security, Backup, Speed, & Growth <= 13.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpvideo ShortcodeCVE-2024-43926.4 Medium
- automattic wp job managerWordPress WP Job Manager plugin <= 2.2.2 - Sensitive Data Exposure vulnerabilityCVE-2024-345495.3 Medium
- automattic jetpackWordPress Jetpack plugin < 12.7 - Auth. Iframe Injection vulnerabilityCVE-2023-477745.4 Medium
- automattic woocommerceWooCommerce < 8.6 - Contributor+ Private/Draft Products AccessCVE-2024-13104.9 Medium
- automattic wp job managerWordPress WP Job Manager plugin <= 2.0.0 - Broken Access Control vulnerabilityCVE-2023-522115.3 Medium
- automattic woocommerceWordPress WooCommerce plugin <= 8.5.2 - Cross Site Request Forgery (CSRF) vulnerabilityCVE-2024-221554.3 Medium
- automattic crowdsignal dashboard, automattic, inc. crowdsignal dashboard – polls, surveys & more +1 moreWordPress Crowdsignal Polls & Ratings plugin <= 3.0.11 - Cross Site Request Forgery (CSRF) vulnerabilityCVE-2023-514895.4 Medium
- automattic sensei lms – online courses, quizzes, & learning, sensei lms +1 moreWordPress Sensei LMS Plugin <= 4.17.0 is vulnerable to Cross Site Scripting (XSS)CVE-2023-508756.5 Medium
- Show moreLoading…