Automattic: plugin vulnerabilities

9 plugins by Automattic in our catalogue, with the known vulnerabilities on record for each. Plugins of theirs that we do not track are not listed.

Newest records across these plugins

“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.

• medium 6.5 Jetpack VideoPress

  Missing authorization check

  CVE-2026-40808 · affected 3.6 and older · fixed in 3.7 · published 2026-10-10

• high 7.2 WooCommerce

  Privilege escalation

  CVE-2026-106608 · affected 9.8.0 to 11.1.2 · fixed in 11.2.0 · published 2026-10-10

• medium 4.8 Jetpack

  Authentication bypass

  CVE-2026-106602 · affected 16.2 and older · fixed in 16.3 · published 2026-10-09

• medium 5.4 Jetpack

  Authentication bypass

  CVE-2026-106601 · affected 16.2 and older · fixed in 16.3 · published 2026-10-09

• high 7.5 WooCommerce

  Denial of service

  CVE-2026-48888 · affected older than 11.1.0 · fixed in 11.1.0 · published 2026-09-08

• high 7.6 WooCommerce

  SQL injection

  CVE-2026-57777 · affected older than 11.0 · fixed in 11.0 · published 2026-09-04

• high 7.5 WooCommerce

  Cross-site request forgery (CSRF)

  CVE-2026-3589 · affected 5.4.0 up to (not including) 5.4.4, 5.5.0 up to (not including) 5.4.5, 5.6.0 up to (not including) 5.6.3, 5.7.0 up to (not including) 5.7.3, 5.8.0 up to (not including) 5.8.2, 5.9.0 up to (not including) 5.9.2, 6.0.0 up to (not including) 6.0.2, 6.1.0 up to (not including) 6.1.3, 6.2.0 up to (not including) 6.2.3, 6.3.0 up to (not including) 6.3.2, 6.4.0 up to (not including) 6.4.2, 6.5.0 up to (not including) 6.5.2, 6.6.0 up to (not including) 6.6.2, 6.7.0 up to (not including) 6.7.1, 6.8.0 up to (not including) 6.8.3, 6.9.0 up to (not including) 6.9.5, 7.0.0 up to (not including) 7.0.2, 7.1.0 up to (not including) 7.1.2, 7.2.0 up to (not including) 7.2.4, 7.3.0 up to (not including) 7.3.1, 7.4.0 up to (not including) 7.4.2, 7.5.0 up to (not including) 7.5.2, 7.6.0 up to (not including) 7.6.2, 7.7.0 up to (not including) 7.7.3, 7.8.0 up to (not including) 7.8.4, 7.9.0 up to (not including) 7.9.2, 8.0.0 up to (not including) 8.0.5, 8.1.0 up to (not including) 8.1.4, 8.2.0 up to (not including) 8.2.5, 8.3.0 up to (not including) 8.3.4, 8.4.0 up to (not including) 8.4.3, 8.5.0 up to (not including) 8.5.5, 8.6.0 up to (not including) 8.6.4, 8.7.0 up to (not including) 8.7.3, 8.8.0 up to (not including) 8.8.7, 8.9.0 up to (not including) 8.9.5, 9.0.0 up to (not including) 9.0.4, 9.1.0 up to (not including) 9.1.7, 9.2.0 up to (not including) 9.2.5, 9.3.0 up to (not including) 9.3.6, 9.4.0 up to (not including) 9.4.5, 9.5.0 up to (not including) 9.5.4, 9.6.0 up to (not including) 9.6.4, 9.7.0 up to (not including) 9.7.3, 9.8.0 up to (not including) 9.8.7, 9.9.0 up to (not including) 9.9.7, 10.0.0 up to (not including) 10.0.6, 10.1.0 up to (not including) 10.1.4, 10.2.0 up to (not including) 10.2.4, 10.3.0 up to (not including) 10.3.8, 10.4.0 up to (not including) 10.4.4, 10.5.0 up to (not including) 10.5.3 · fixed in 10.5.3 · published 2026-03-06

• high 7.5 Jetpack CRM

  File inclusion

  CVE-2026-22356 · affected 6.7.0 and older · fixed in 6.7.1 · published 2026-02-20

• medium 5.3 WP Job Manager

  Missing authorization check

  CVE-2026-25404 · affected 2.4.0 and older · fixed in 2.4.1 · published 2026-02-19

• medium 6.1 Jetpack

  Cross-site scripting (XSS)

  CVE-2023-54332 · affected 11.4 only · fixed in 11.4.1 * · published 2026-01-13

• medium 5.4 WP Job Manager

  Cross-site request forgery (CSRF)

  CVE-2023-52212 · affected 2.0.0 and older · fixed in 2.1.0 · published 2026-01-05

• low 3.8 Crowdsignal Forms

  Missing authorization check

  CVE-2025-69015 · affected 1.7.2 and older · fixed in 1.8.0 · published 2025-12-30

• medium 6.5 WooCommerce

  Information disclosure

  CVE-2025-15033 · affected 8.1.0 up to (not including) 8.1.3, 8.2.0 up to (not including) 8.2.4, 8.3.0 up to (not including) 8.3.3, 8.4.0 up to (not including) 8.4.2, 8.5.0 up to (not including) 8.5.4, 8.6.0 up to (not including) 8.6.3, 8.7.0 up to (not including) 8.7.2, 8.8.0 up to (not including) 8.8.6, 8.9.0 up to (not including) 8.9.4, 9.0.0 up to (not including) 9.0.3, 9.1.0 up to (not including) 9.1.5, 9.2.0 up to (not including) 9.2.4, 9.3.0 up to (not including) 9.3.5, 9.4.0 up to (not including) 9.4.4, 9.5.0 up to (not including) 9.5.3, 9.6.0 up to (not including) 9.6.3, 9.7.0 up to (not including) 9.7.2, 9.8.0 up to (not including) 9.8.6, 9.9.0 up to (not including) 9.9.6, 10.0.0 up to (not including) 10.0.5, 10.1.0 up to (not including) 10.1.3, 10.2.0 up to (not including) 10.2.3, 10.3.0 up to (not including) 10.3.7, 10.4.0 up to (not including) 10.4.3 · fixed in 10.4.3 · published 2025-12-22

• medium 5.3 WooCommerce

  Information disclosure

  CVE-2023-7320 · affected 7.8.2 and older · fixed in 7.8.3 * · published 2025-10-29

• medium 5.9 WooCommerce

  Stored cross-site scripting (XSS)

  CVE-2025-49042 · affected 10.0.2 and older · fixed in 10.0.3 · published 2025-10-29

• medium 6.1 WooCommerce

  Cross-site scripting (XSS)

  CVE-2025-5062 · affected 9.3.2 and older, 9.4 to 9.4.2 · fixed in 9.4.3 * · published 2025-05-22

• medium 5.9 Jetpack

  Stored cross-site scripting (XSS)

  CVE-2024-10076 · affected older than 13.8 · fixed in 13.8 · published 2025-05-15

• medium 5.6 Jetpack

  Security issue

  CVE-2024-10075 · affected older than 13.8 · fixed in 13.8 · published 2025-05-15

• medium 5.9 WooCommerce

  Stored cross-site scripting (XSS)

  CVE-2025-26762 · affected 9.7.0 and older · fixed in 9.7.1 · published 2025-03-27

• medium 6.1 Jetpack

  Cross-site scripting (XSS)

  CVE-2024-10858 · affected 13.0 up to (not including) 14.1 · fixed in 14.1 · published 2024-12-25

Ran a vulnerable version? Check your site for signs of a hack

The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.

Scan free

Browse vulnerabilities

• Published this week
• Unpatched in the latest version
• By type of vulnerability

Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution

Where this data comes from

• Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
• Plugin versions, update dates and install counts: the wordpress.org Plugins API.
• These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.

← Check a plugin · Free hacked-site scan