Log in Start free

Automattic

Products

ProductCVEsExploitedLatest
WooCommerce16–Oct 10, 2026
Jetpack5–Oct 9, 2026
WordPress4–Oct 6, 2026
WP Job Manager4–Feb 19, 2026
WooPayments – Fully Integrated Solution Built and Supported by Woo4–Dec 31, 2023
Newspack Blocks4–Nov 1, 2024
Sensei LMS4–Oct 19, 2026
Newspack Newsletters3–Jun 6, 2025
Jetpack – WP Security, Backup, Speed, & Growth3–May 14, 2024
mongoose2–Aug 13, 2026
WP Job Manager - Resume Manager2–Jan 2, 2025
automattic/mongoose2–Jul 17, 2023
Newspack Ads1–Jul 4, 2024
Newspack Campaigns1–Jul 4, 2024
Newspack Content Converter1–Nov 1, 2024
Sensei LMS – Online Courses, Quizzes, & Learning1–Feb 12, 2024
Sensei Pro (WC Paid Courses)1–Aug 18, 2024
WooCommerce Blocks1–Nov 30, 2023
WordPress.com Editing Toolkit1–Dec 29, 2023
WP Super Cache1–Jun 1, 2021
ChaosTheory1–Jun 3, 2024
Crowdsignal Dashboard – Polls, Surveys & more1–Nov 19, 2024
Crowdsignal Forms1–Dec 30, 2025
Developer1–Sep 22, 2025
GHActivity1–Aug 29, 2024
Jetpack CRM1–Feb 20, 2026
Jetpack CRM – Clients, Leads, Invoices, Billing, Email Marketing, & Automation1–Oct 20, 2023
Jetpack Debug Tools1–May 15, 2025
Jetpack VideoPress1–Oct 10, 2026
Limit Login Attempts1–Apr 6, 2023
Newspack1–Nov 1, 2024

Exploited and recent CVEs

  • CVE-2026-112329 Medium 4.3 Sensei LMS 4.26.4 Broken Access Control via save_new_message 0.2%
  • CVE-2026-112328 Medium 4.3 Sensei LMS 4.26.4 Broken Access Control via add_new_module_term AJAX 0.2%
  • CVE-2026-40808 Medium 6.5 WordPress Jetpack VideoPress plugin <= 3.6 - Broken Access Control vulnerability 0.3%
  • CVE-2026-106608 High 7.2 WordPress WooCommerce plugin 9.8.0-11.1.2 - Shop Manager+ Privilege Escalation vulnerability 0.3%
  • CVE-2026-106601 Medium 5.4 WordPress Jetpack plugin <= 16.2 - Broken Authentication vulnerability 0.2%
  • CVE-2026-106602 Medium 4.8 WordPress Jetpack plugin <= 16.2 - Broken Authentication vulnerability 0.2%
  • CVE-2026-66666 Medium 6.9 WordPress Core <= 7.1.2 - Unauthenticated Sensitive Data Exposure of Comments on Private and Unpublished Posts via Comment Feed vulnerability 0.4%
  • CVE-2026-93485 High 7.1 WordPress Core <= 7.1 - Cross Site Scripting (XSS) vulnerability 0.7%
  • CVE-2026-48888 High 7.5 WordPress WooCommerce plugin < 11.1.0 - Denial of Service Attack vulnerability 0.5%
  • CVE-2026-57777 High 7.6 WordPress WooCommerce plugin < 11.0 - SQL Injection vulnerability 0.4%
  • CVE-2026-73562 Medium 6.5 Mongoose: Prototype pollution in the update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter) 0.5%
  • CVE-2026-42334 High 7.5 Mongoose: Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection 0.3%
  • CVE-2026-3589 High 7.5 WooCommerce < 10.5.3 - Arbitrary Admin User Creation via CSRF 0.1%
  • CVE-2026-22356 High 7.5 WordPress Jetpack CRM plugin <= 6.7.0 - Local File Inclusion vulnerability 0.5%
  • CVE-2026-25404 Medium 5.3 WordPress WP Job Manager plugin <= 2.4.0 - Broken Access Control vulnerability 0.3%
  • CVE-2023-54332 Medium 6.1 Jetpack 11.4 - Cross Site Scripting (XSS) 0.3%
  • CVE-2023-52212 Medium 5.4 WordPress WP Job Manager plugin <= 2.0.0 - Cross Site Request Forgery (CSRF) vulnerability 0.1%
  • CVE-2025-69015 Low 3.8 WordPress Crowdsignal Forms plugin <= 1.7.2 - Broken Access Control vulnerability 0.4%
  • CVE-2025-15033 Medium 6.5 WooCommerce - Subscriber/Customer+ Order Data Disclosure 0.3%
  • CVE-2023-7320 Medium 5.3 WooCommerce <= 7.8.2 - Sensitive Information Exposure 0.3%
  • CVE-2025-49042 Medium 5.9 WordPress WooCommerce plugin <= 10.0.2 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2025-57924 Medium 4.3 WordPress Developer Plugin <= 1.2.6 - Cross Site Request Forgery (CSRF) Vulnerability 0.2%
  • CVE-2025-49325 Medium 4.7 WordPress Newspack Newsletters plugin <= 3.13.0 - Open Redirection Vulnerability 0.3%
  • CVE-2025-5062 Medium 6.1 WooCommerce <= 9.4.2 - PostMessage-Based Cross-Site Scripting 0.5%
  • CVE-2024-56006 Medium 5.3 WordPress Jetpack Debug Tools plugin < 2.0.1 - Broken Access Control vulnerability 0.3%
  • CVE-2025-22740 Medium 5.3 WordPress Sensei LMS plugin <= 4.24.4 - Broken Access Control vulnerability 0.3%
  • CVE-2025-26762 Medium 5.9 WordPress WooCommerce plugin <= 9.7.0 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2024-37241 Medium 4.3 WordPress WP Job Manager Resume Manager plugin <= 2.1.0 - Cross Site Request Forgery (CSRF) vulnerability 0.2%
  • CVE-2024-37242 Medium 4.3 WordPress Newspack Newsletters plugin <= 2.13.2 - Cross Site Request Forgery (CSRF) vulnerability 0.2%
  • CVE-2024-43338 Medium 4.3 WordPress Crowdsignal Polls & Ratings plugin <= 3.1.3 - Cross Site Request Forgery (CSRF) vulnerability 0.2%