Automattic Vulnerabilities and Affected Products
Vulnerabilities associated with Jetpack.
Products
Clear product- WooCommerce15 vulnerabilities
- Jetpack4 vulnerabilities
- Newspack Blocks4 vulnerabilities
- WooPayments – Fully Integrated Solution Built and Supported by Woo4 vulnerabilities
- WP Job Manager4 vulnerabilities
- Jetpack – WP Security, Backup, Speed, & Growth3 vulnerabilities
- mongoose3 vulnerabilities
- Newspack Newsletters3 vulnerabilities
- newspack_newsletters3 vulnerabilities
- automattic/mongoose2 vulnerabilities
- Sensei LMS2 vulnerabilities
- sensei_lms2 vulnerabilities
- WordPress2 vulnerabilities
- WP Job Manager - Resume Manager2 vulnerabilities
- wp_job_manager2 vulnerabilities
- activitypub1 vulnerability
- ChaosTheory1 vulnerability
- Crowdsignal Dashboard – Polls, Surveys & more1 vulnerability
- Crowdsignal Forms1 vulnerability
- Developer1 vulnerability
- GHActivity1 vulnerability
- Jetpack CRM1 vulnerability
- Jetpack CRM – Clients, Leads, Invoices, Billing, Email Marketing, & Automation1 vulnerability
- Jetpack Debug Tools1 vulnerability
- Limit Login Attempts1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2023-54332MEDIUM | Jetpack 11.4 - Cross Site Scripting (XSS)Jetpack 11.4 contains a cross-site scripting vulnerability in the contact form module that allows attackers to inject malicious scripts through the post_id parameter. Attackers can craft malicious URLs with script payloads to execute arbitrary JavaScript in victims' browsers when they interact with the contact form page. CWE-79Jan 13, 2026 | CVSS5.1v4.0 | EPSS0.25% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-9926MEDIUM | Jetpack < 13.9.1 - Subscriber+ Arbitrary Feedback AccessThe Jetpack WordPress plugin does not have proper authorisation in one of its REST endpoint, allowing any authenticated users, such as subscriber to read arbitrary feedbacks data sent via the Jetpack Contact Form CWE-863Nov 7, 2024 | CVSS4.3v3.1 | EPSS1.15% | PoCs2 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-47788MEDIUM | WordPress Jetpack plugin < 12.7 - Contributor+ Broken Access Control vulnerabilityMissing Authorization vulnerability in Automattic Jetpack.This issue affects Jetpack: from n/a before 12.7. CWE-862Jun 19, 2024 | CVSS4.3v3.1 | EPSS0.393% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-47774MEDIUM | WordPress Jetpack plugin < 12.7 - Auth. Iframe Injection vulnerabilityImproper Restriction of Rendered UI Layers or Frames vulnerability in Automattic Jetpack allows Clickjacking.This issue affects Jetpack: from n/a before 12.7. CWE-1021Apr 24, 2024 | CVSS5.4v3.1 | EPSS0.272% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |