Automattic Activitypub
5 CVEs affecting Automattic Activitypub. Latest disclosed: 2026-04-08. Critical: 0, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-4338 | High | 7.5 | 2026-04-08 | The ActivityPub WordPress plugin before 8.0.2 does not properly filter posts to be displayed, allowed unauthenticated users to access drafts/scheduled/pending… |
CVE-2023-5057 | Medium | 5.4 | 2023-10-16 | The ActivityPub WordPress plugin before 1.0.0 does not escape user metadata before outputting them in mentions, which could allow users with a role of Contribu… |
CVE-2023-3746 | Medium | 5.4 | 2023-10-16 | The ActivityPub WordPress plugin before 1.0.0 does not sanitize and escape some data from post content, which could allow contributor and above role to perform… |
CVE-2023-3707 | Medium | 4.3 | 2023-10-16 | The ActivityPub WordPress plugin before 1.0.0 does not ensure that post contents to be displayed are public and belong to the plugin, allowing any authenticate… |
CVE-2023-3706 | Medium | 4.3 | 2023-10-16 | The ActivityPub WordPress plugin before 1.0.0 does not ensure that post titles to be displayed are public and belong to the plugin, allowing any authenticated… |