Automattic
Page 2 of 2 — Automattic CVEs from a corpus of 118, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-24323 | Medium | 4.8 | 2021-05-17 | When taxes are enabled, the "Additional tax classes" field was not properly sanitised or escaped before being output back in the admin dashboard, allowing high… |
CVE-2021-24209 | High | 7.2 | 2021-04-05 | The WP Super Cache WordPress plugin before 1.7.2 was affected by an authenticated (admin+) RCE in the settings page due to input validation failure and weak $c… |
CVE-2020-8215 | High | 8.8 | 2020-07-20 | A buffer overflow is present in canvas version <= 1.6.9, which could lead to a Denial of Service or execution of arbitrary code when it processes a user-provid… |
CVE-2019-11843 | Medium | 6.1 | 2020-06-02 | The MailPoet plugin before 3.23.2 for WordPress allows remote attackers to inject arbitrary web script or HTML using extra parameters in the URL (Reflective Se… |
CVE-2013-2010 | Critical | 9.8 | 2020-02-12 | WordPress W3 Total Cache Plugin 0.9.2.8 has a Remote PHP Code Execution Vulnerability |
CVE-2013-2009 | High | 8.8 | 2020-02-07 | WordPress WP Super Cache Plugin 1.2 has Remote PHP Code Execution |
CVE-2013-2008 | Medium | 6.1 | 2020-02-07 | WordPress Super Cache Plugin 1.3 has XSS. |
CVE-2013-2011 | High | 8.8 | 2019-12-26 | WordPress W3 Super Cache Plugin before 1.3.2 contains a PHP code-execution vulnerability which could allow remote attackers to inject arbitrary code. This issu… |
CVE-2015-9359 | Medium | 6.1 | 2019-08-28 | The Jetpack plugin before 3.4.3 for WordPress has XSS via add_query_arg() and remove_query_arg(). |
CVE-2015-9357 | Medium | 6.1 | 2019-08-28 | The akismet plugin before 3.1.5 for WordPress has XSS. |
CVE-2016-10763 | Medium | 4.8 | 2019-07-18 | The CampTix Event Ticketing plugin before 1.5 for WordPress allows XSS in the admin section via a ticket title or body. |
CVE-2016-10762 | High | 7.5 | 2019-07-18 | The CampTix Event Ticketing plugin before 1.5 for WordPress allows CSV injection when the export tool is used. |
CVE-2016-10706 | Medium | 6.1 | 2018-01-12 | The Jetpack plugin before 4.0.3 for WordPress has XSS via a crafted Vimeo link. |
CVE-2016-10705 | Medium | 6.1 | 2018-01-12 | The Jetpack plugin before 4.0.4 for WordPress has XSS via the Likes module. |
CVE-2017-17058 | High | 7.5 | 2017-11-29 | The WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/woocommerce/templates/emails/plain/ URI, whi… |
CVE-2015-3429 | | 2015-06-17 | Cross-site scripting (XSS) vulnerability in example.html in Genericons before 3.3.1, as used in WordPress before 4.2.2, allows remote attackers to inject arbit… | |
CVE-2014-0173 | | 2014-04-22 | The Jetpack plugin before 1.9 before 1.9.4, 2.0.x before 2.0.9, 2.1.x before 2.1.4, 2.2.x before 2.2.7, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2… | |
CVE-2011-4673 | | 2011-12-02 | SQL injection vulnerability in modules/sharedaddy.php in the Jetpack plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the id… |