Automattic

74 CVEs across 56 Automattic products. Browse Automattic vulnerabilities, severities, and proof-of-concept exploits.

Automattic products with known CVEs

ProductCVEs
Jetpack16
Woocommerce15
Sensei Lms6
Wp Super Cache6
Activitypub5
Woopayments5
Crowdsignal Dashboard4
Jetpack Crm4
Newspack Blocks4
Woopayments – Fully Integrated Solution Built And Supported By Woo4
Wp Job Manager4
Jetpack – Wp Security, Backup, Speed, & Growth3
Mailpoet3
Newspack Newsletters3
Automattic/mongoose2
Camptix Event Ticketing2
Jetpack Boost2
Mongoose2
Sensei Lms2
Vaultpress2
Woocommerce Blocks2
Woocommerce Bookings2
Wordpress2
Wp Job Manager - Resume Manager2
Akismet1
Canada Post Shipping Method1
Canvas1
Chaostheory1
Crowdsignal Dashboard – Polls, Surveys & More1
Crowdsignal Forms1
Developer1
Genericons1
Ghacitivity1
Ghactivity1
Jetpack Crm1
Jetpack Crm – Clients, Leads, Invoices, Billing, Email Marketing, & Automation1
Jetpack Debug Tools1
Limit Login Attempts1
Newspack1
Newspack Ads1
Newspack Ads1
Newspack Campaigns1
Newspack Content Converter1
Newspack Popups1
Sensei Lms – Online Courses, Quizzes, & Learning1
Sensei Pro (Wc Paid Courses)1
W3 Super Cache1
Woocommerce Blocks1
Woocommerce Gocardless1
Woocommerce Payments1
Automattic CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-73562Medium6.52026-08-13Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.10, 7.8.10, 8.24.1, and 9.7.2, passing a user-control…
CVE-2026-42334High7.52026-05-14Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.9, 7.8.9, 8.22.1, and 9.1.6, a vulnerability allows b…
CVE-2026-4338High7.52026-04-08The ActivityPub WordPress plugin before 8.0.2 does not properly filter posts to be displayed, allowed unauthenticated users to access drafts/scheduled/pending…
CVE-2026-3589High7.52026-03-06The WooCommerce WordPress plugin from versions 5.4.0 to 10.5.2 does not properly handle batch requests, which could allow unauthenticated users to make a logge…
CVE-2026-22356High7.52026-02-20Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Automattic Jetpack CRM zero-bs-crm all…
CVE-2026-25404Medium5.32026-02-19Missing Authorization vulnerability in Automattic WP Job Manager wp-job-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This is…
CVE-2023-54332Medium6.12026-01-13Jetpack 11.4 contains a cross-site scripting vulnerability in the contact form module that allows attackers to inject malicious scripts through the post_id par…
CVE-2023-52212Medium5.42026-01-05Cross-Site Request Forgery (CSRF) vulnerability in Automattic WP Job Manager allows Cross Site Request Forgery.This issue affects WP Job Manager: from n/a thro…
CVE-2025-69015Low3.82025-12-30Missing Authorization vulnerability in Automattic Crowdsignal Forms crowdsignal-forms allows Exploiting Incorrectly Configured Access Control Security Levels.T…
CVE-2025-15033Medium6.52025-12-22A vulnerability in WooCommerce 8.1 to 10.4.2 can allow logged-in customers to access order data of guest customers on sites with a certain configuration. This…
CVE-2023-7320Medium5.32025-10-29The WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 7.8.2, due to improper CORS handling on…
CVE-2025-49042Medium5.92025-10-29Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooCommerce woocommerce allows Stored XSS.This…
CVE-2025-57924Medium4.32025-09-22Cross-Site Request Forgery (CSRF) vulnerability in Automattic Developer allows Cross Site Request Forgery. This issue affects Developer: from n/a through 1.2.6.
CVE-2025-49325Medium4.72025-06-06URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Automattic Newspack Newsletters newspack-newsletters allows Phishing.This issue affects Ne…
CVE-2025-5062Medium6.12025-05-22The WooCommerce plugin for WordPress is vulnerable to PostMessage-Based Cross-Site Scripting via the 'customize-store' page in all versions up to, and includin…
CVE-2024-8009Medium4.32025-05-15The Sensei LMS WordPress plugin before 4.20.0 disclose all users of the blog including their email address to teachers on the students page
CVE-2024-6584Critical9.12025-05-15The 'wp_ajax_boost_proxy_ig' action allows administrators to make GET requests to arbitrary URLs.
CVE-2024-12743Medium4.82025-05-15The MailPoet WordPress plugin before 5.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform…
CVE-2024-10076Medium5.92025-05-15The Jetpack WordPress plugin before 13.8, Jetpack Boost WordPress plugin before 3.4.8 use regexes in the Site Accelerator features when switching image URLs…
CVE-2024-10075Medium5.62025-05-15The Jetpack WordPress plugin before 13.8 does not ensure that the post created by the Contact Form is only accessible to authorised users, which could allow u…
CVE-2024-56006Medium5.32025-05-15Missing Authorization vulnerability in Automattic Jetpack Debug Tools.This issue affects Jetpack Debug Tools: from n/a before 2.0.1.
CVE-2025-22740Medium5.32025-03-27Missing Authorization vulnerability in Automattic Sensei LMS sensei-lms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe…
CVE-2025-26762Medium5.92025-03-27Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooCommerce woocommerce allows Stored XSS.This…
CVE-2025-0466Medium5.32025-02-04The Sensei LMS WordPress plugin before 4.24.4 does not properly protect some its REST API routes, allowing unauthenticated attackers to leak sensei_email and s…
CVE-2024-37241Medium4.32025-01-02Cross-Site Request Forgery (CSRF) vulnerability in Automattic WP Job Manager - Resume Manager allows Cross Site Request Forgery.This issue affects WP Job Manag…
CVE-2024-37242Medium4.32025-01-02Cross-Site Request Forgery (CSRF) vulnerability in Automattic Newspack Newsletters newspack-newsletters allows Cross Site Request Forgery.This issue affects Ne…
CVE-2024-10858Medium6.12024-12-25The Jetpack WordPress plugin before 14.1 does not properly checks the postmessage origin in its 13.x versions, allowing it to be bypassed and leading to DOM-X…
CVE-2024-43338Medium4.32024-11-19Cross-Site Request Forgery (CSRF) vulnerability in Automattic Crowdsignal Dashboard – Polls, Surveys & more polldaddy allows Cross Site Request Forgery.This is…
CVE-2024-10103Medium6.12024-11-19In the process of testing the MailPoet WordPress plugin before 5.3.2, a vulnerability was found that allows you to implement Stored XSS on behalf of the edito…
CVE-2024-9926Medium4.32024-11-07The Jetpack WordPress plugin does not have proper authorisation in one of its REST endpoint, allowing any authenticated users, such as subscriber to read arbit…
CVE-2024-43968Medium4.32024-11-01Broken Access Control vulnerability in Automattic Newspack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Newspack…
CVE-2024-37477Medium6.52024-11-01Missing Authorization vulnerability in Automattic Newspack Content Converter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue…
CVE-2024-37475Medium5.32024-11-01Missing Authorization vulnerability in Automattic Newspack Newsletters allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Newsp…
CVE-2024-37443Medium4.32024-11-01Missing Authorization vulnerability in Automattic WP Job Manager - Resume Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This…
CVE-2024-37425Medium5.42024-11-01Missing Authorization vulnerability in Automattic Newspack Blocks newspack-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This…
CVE-2024-37423High8.52024-11-01Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Automattic Newspack Blocks allows Path Traversal.This issue aff…
CVE-2024-9944Medium5.32024-10-15The WooCommerce plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 9.0.2. This is due to the plugin not properly neutra…
CVE-2024-7786Medium5.32024-09-04The Sensei LMS WordPress plugin before 4.24.2 does not properly protect some its REST API routes, allowing unauthenticated attackers to leak email templates.
CVE-2024-43949Medium6.52024-08-29Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Automattic GHActivity allows Stored XSS.This issue…
CVE-2024-35686Medium5.32024-08-18Missing Authorization vulnerability in Automattic Sensei LMS, Automattic Sensei Pro (WC Paid Courses).This issue affects Sensei LMS: from n/a through 4.23.1; S…
CVE-2024-39666Medium5.92024-08-18Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Automattic WooCommerce.This issue affects WooComme…
CVE-2024-37115High7.52024-07-10Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Automattic Newspack Blocks.This issue affects Newspack Blocks: from n/a through 3.0…
CVE-2024-37424Critical9.92024-07-09Unrestricted Upload of File with Dangerous Type vulnerability in Automattic Newspack Blocks allows Upload a Web Shell to a Web Server.This issue affects Newspa…
CVE-2024-35777Low3.52024-07-09Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Automattic WooCommerce allows Content Spoof…
CVE-2024-37474Medium6.52024-07-04Cross Site Scripting (XSS) vulnerability in Automattic Newspack Ads allows Stored XSS.This issue affects Newspack Ads: from n/a through 1.47.1.
CVE-2024-37476Medium6.52024-07-04Cross Site Scripting (XSS) vulnerability in Automattic Newspack Campaigns allows Stored XSS.This issue affects Newspack Campaigns: from n/a through 2.31.1.
CVE-2024-32111Medium5.02024-06-25Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Automattic WordPress allows Relative Path Traversal.This issue…
CVE-2024-31111Medium6.52024-06-25Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Automattic WordPress allows Stored XSS.This issue…
CVE-2023-47788Medium4.32024-06-19Missing Authorization vulnerability in Automattic Jetpack.This issue affects Jetpack: from n/a before 12.7.
CVE-2024-34766Medium6.52024-06-03Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Automattic ChaosTheory allows Stored XSS.This issu…
CVE-2024-4392Medium6.42024-05-14The Jetpack – WP Security, Backup, Speed, & Growth plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpvideo shortcode in all…
CVE-2024-34549Medium5.32024-05-14Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Automattic WP Job Manager.This issue affects WP Job Manager: from n/a through 2.2.2.
CVE-2023-47774Medium5.42024-04-24Improper Restriction of Rendered UI Layers or Frames vulnerability in Automattic Jetpack allows Clickjacking.This issue affects Jetpack: from n/a before 12.7.
CVE-2024-1310Medium4.92024-04-15The WooCommerce WordPress plugin before 8.6 does not prevent users with at least the contributor role from leaking products they shouldn't have access to. (e.g…
CVE-2023-52211Medium5.32024-04-12Missing Authorization vulnerability in Automattic WP Job Manager.This issue affects WP Job Manager: from n/a through 2.0.0.
CVE-2024-22155Medium4.32024-04-07Cross-Site Request Forgery (CSRF) vulnerability in Automattic WooCommerce.This issue affects WooCommerce: from n/a through 8.5.2.
CVE-2023-51489Medium5.42024-03-16Cross-Site Request Forgery (CSRF) vulnerability in Automattic, Inc. Crowdsignal Dashboard – Polls, Surveys & more.This issue affects Crowdsignal Dashboard – Po…
CVE-2023-50875Medium6.52024-02-12Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic Sensei LMS – Online Courses, Quizzes, & Learni…
CVE-2023-51488High7.12024-02-10Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic, Inc. Crowdsignal Dashboard – Polls, Surveys &…
CVE-2023-52222Medium4.32024-01-08Cross-Site Request Forgery (CSRF) vulnerability in Automattic WooCommerce.This issue affects WooCommerce: from n/a through 8.2.2.
CVE-2023-51502High7.52024-01-05Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce WooCommerce Stripe Payment Gateway.This issue affects WooCommerce Stripe Payment…
CVE-2023-51503Medium5.92023-12-31Authorization Bypass Through User-Controlled Key vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo.This issue affe…
CVE-2023-50879Medium6.52023-12-29Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WordPress.Com Editing Toolkit allows Stored XS…
CVE-2023-32747Medium5.42023-12-21Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce WooCommerce Bookings.This issue affects WooCommerce Bookings: from n/a through 1…
CVE-2023-35916High7.52023-12-20Authorization Bypass Through User-Controlled Key vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo.This issue affe…
CVE-2023-35915High7.62023-12-20Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Automattic WooPayments – Fully Integrated Solution Built…
CVE-2023-35914High7.52023-12-20Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce Woo Subscriptions.This issue affects Woo Subscriptions: from n/a through 5.1.2.
CVE-2023-35876High8.12023-12-20Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce WooCommerce Square.This issue affects WooCommerce Square: from n/a through 3.8.1.
CVE-2023-37871High8.22023-12-20Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce GoCardless.This issue affects GoCardless: from n/a through 2.5.6.
CVE-2023-47789Medium4.32023-12-18Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce Canada Post Shipping Method.This issue affects Canada Post Shipping Method: from n/a through 2.8…
CVE-2023-47787Medium4.32023-12-18Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce WooCommerce Bookings.This issue affects WooCommerce Bookings: from n/a through 2.0.3.
CVE-2023-49828Medium6.52023-12-14Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooPayments – Fully Integrated Solution Built…
CVE-2023-47777Medium6.52023-11-30Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooCommerce, Automattic WooCommerce Blocks all…
CVE-2023-45050Medium6.52023-11-30Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic Jetpack – WP Security, Backup, Speed, & Growth…
CVE-2022-3342High7.52023-10-20The Jetpack CRM plugin for WordPress is vulnerable to PHAR deserialization via the ‘zbscrmcsvimpf’ parameter in the 'zeroBSCRM_CSVImporterLitehtml_app' functio…
CVE-2023-5057Medium5.42023-10-16The ActivityPub WordPress plugin before 1.0.0 does not escape user metadata before outputting them in mentions, which could allow users with a role of Contribu…
CVE-2023-3746Medium5.42023-10-16The ActivityPub WordPress plugin before 1.0.0 does not sanitize and escape some data from post content, which could allow contributor and above role to perform…
CVE-2023-3707Medium4.32023-10-16The ActivityPub WordPress plugin before 1.0.0 does not ensure that post contents to be displayed are public and belong to the plugin, allowing any authenticate…
CVE-2023-3706Medium4.32023-10-16The ActivityPub WordPress plugin before 1.0.0 does not ensure that post titles to be displayed are public and belong to the plugin, allowing any authenticated…
CVE-2023-3696Critical9.82023-07-17Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4.
CVE-2023-2996High8.82023-06-27The Jetpack WordPress plugin before 12.1.1 does not validate uploaded files, allowing users with author roles or above to manipulate existing files on the site…
CVE-2023-27429Medium5.92023-06-21Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Automattic - Jetpack CRM team Jetpack CRM plugin <= 5.4.4 versions.
CVE-2014-125104Medium6.32023-06-01A vulnerability was found in VaultPress Plugin up to 1.6.0 on WordPress. It has been declared as critical. Affected by this vulnerability is the function prote…
CVE-2023-28121Critical9.82023-04-12An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an unauthenticated attacker to send requests on behalf of an elevated u…
CVE-2023-1912High7.22023-04-06The Limit Login Attempts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its lock logging feature in versions up to, and including, 1.7.1…
CVE-2022-4497Medium5.42023-01-09The Jetpack CRM WordPress plugin before 5.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could…
CVE-2022-3919Medium4.82022-12-12The Jetpack CRM WordPress plugin before 5.4.3 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scri…
CVE-2022-45069Medium6.32022-11-17Auth. (contributor+) Privilege Escalation vulnerability in Crowdsignal Dashboard plugin <= 3.0.9 on WordPress.
CVE-2022-2080Medium4.32022-08-29The Sensei LMS WordPress plugin before 4.5.2 does not ensure that the sender of a private message is either the teacher or the original sender, allowing any au…
CVE-2022-2034Medium5.32022-08-29The Sensei LMS WordPress plugin before 4.5.0 does not have proper permissions set in one of its REST endpoint, allowing unauthenticated users to access private…
CVE-2022-2386Medium6.12022-08-08The Crowdsignal Dashboard WordPress plugin before 3.0.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected…
CVE-2022-2564Critical9.82022-07-28Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6.
CVE-2017-20086Medium6.32022-06-23A vulnerability, which was classified as critical, was found in VaultPress Plugin 1.8.4. This affects an unknown part. The manipulation leads to code injection…
CVE-2021-32789High7.52021-07-26woocommerce-gutenberg-products-block is a feature plugin for WooCommerce Gutenberg Blocks. An SQL injection vulnerability impacts all WooCommerce sites running…
CVE-2021-24374Medium5.32021-06-21The Jetpack Carousel module of the JetPack WordPress plugin before 9.8 allows users to create a "carousel" type image gallery and allows users to comment on th…
CVE-2021-24329Medium5.42021-06-01The WP Super Cache WordPress plugin before 1.7.3 did not properly sanitise its wp_cache_location parameter in its settings, which could lead to a Stored Cross-…
CVE-2021-24312High7.22021-06-01The parameters $cache_path, $wp_cache_debug_ip, $wp_super_cache_front_page_text, $cache_scheduled_time, $cached_direct_pages used in the settings of WP Super C…
CVE-2021-24323Medium4.82021-05-17When taxes are enabled, the "Additional tax classes" field was not properly sanitised or escaped before being output back in the admin dashboard, allowing high…
CVE-2021-24209High7.22021-04-05The WP Super Cache WordPress plugin before 1.7.2 was affected by an authenticated (admin+) RCE in the settings page due to input validation failure and weak $c…
CVE-2020-8215High8.82020-07-20A buffer overflow is present in canvas version <= 1.6.9, which could lead to a Denial of Service or execution of arbitrary code when it processes a user-provid…