Automattic Vulnerabilities and Affected Products
Vulnerabilities associated with Newspack Newsletters.
Products
Clear product- WooCommerce15 vulnerabilities
- Jetpack4 vulnerabilities
- Newspack Blocks4 vulnerabilities
- WooPayments – Fully Integrated Solution Built and Supported by Woo4 vulnerabilities
- WP Job Manager4 vulnerabilities
- Jetpack – WP Security, Backup, Speed, & Growth3 vulnerabilities
- mongoose3 vulnerabilities
- Newspack Newsletters3 vulnerabilities
- newspack_newsletters3 vulnerabilities
- automattic/mongoose2 vulnerabilities
- Sensei LMS2 vulnerabilities
- sensei_lms2 vulnerabilities
- WordPress2 vulnerabilities
- WP Job Manager - Resume Manager2 vulnerabilities
- wp_job_manager2 vulnerabilities
- activitypub1 vulnerability
- ChaosTheory1 vulnerability
- Crowdsignal Dashboard – Polls, Surveys & more1 vulnerability
- Crowdsignal Forms1 vulnerability
- Developer1 vulnerability
- GHActivity1 vulnerability
- Jetpack CRM1 vulnerability
- Jetpack CRM – Clients, Leads, Invoices, Billing, Email Marketing, & Automation1 vulnerability
- Jetpack Debug Tools1 vulnerability
- Limit Login Attempts1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2025-49325MEDIUM | WordPress Newspack Newsletters plugin <= 3.13.0 - Open Redirection VulnerabilityURL Redirection to Untrusted Site ('Open Redirect') vulnerability in Automattic Newspack Newsletters newspack-newsletters allows Phishing.This issue affects Newspack Newsletters: from n/a through <= 3.13.0. CWE-601Jun 6, 2025 | CVSS4.7v3.1 | EPSS0.263% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-37242MEDIUM | WordPress Newspack Newsletters plugin <= 2.13.2 - Cross Site Request Forgery (CSRF) vulnerabilityCross-Site Request Forgery (CSRF) vulnerability in Automattic Newspack Newsletters newspack-newsletters allows Cross Site Request Forgery.This issue affects Newspack Newsletters: from n/a through <= 2.13.2. CWE-352Jan 2, 2025 | CVSS4.3v3.1 | EPSS0.197% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-37475MEDIUM | WordPress Newspack Newsletters plugin <= 2.13.2 - Broken Access Control vulnerabilityMissing Authorization vulnerability in Automattic Newspack Newsletters allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Newspack Newsletters: from n/a through 2.13.2. CWE-862Nov 1, 2024 | CVSS5.3v3.1 | EPSS0.42% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |