Automattic
Vulnerability activity for Automattic: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 6
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 10
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 1
Last 365 days
- CVEs
- 12
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 1
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 4.3MediumOct 19, 2026Automattic Sensei LMS Auth bypass / access controlCVE-2026-112329The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the legacy save_new_message handler hooked on the init action, which validates only a generic nonce without verifying course enrollment or restricting post_id to valid post types. Authenticated attackers, including unprivileged Subscribers, can supply an arbitrary post_id for any course, lesson, or quiz to create a private message addressed to that post's author, bypassing the enrollment checks enforc
- 4.3MediumOct 19, 2026Automattic Sensei LMS Auth bypass / access controlCVE-2026-112328The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the add_new_module_term AJAX handler that allows authenticated Teacher-role attackers to assign module taxonomy terms to arbitrary courses by supplying a crafted course_id, since the handler validates only a generic nonce and checks manage_options solely for slug prefixing rather than verifying course edit permissions. Attackers can reuse a nonce obtained from their own course metabox to call wp_set_o
- 6.5MediumOct 10, 2026Automattic Jetpack VideoPress Auth bypass / access controlCVE-2026-40808Subscriber Broken Access Control in Jetpack VideoPress <= 3.6 versions.
- 7.2HighOct 10, 2026Automattic WooCommerce Privilege escalationCVE-2026-106608Incorrect Privilege Assignment vulnerability in Automattic WooCommerce woocommerce allows Privilege Escalation.This issue affects WooCommerce: from 9.8.0 through 11.1.2.
- 4.8MediumOct 9, 2026Automattic Jetpack Auth bypass / access controlCVE-2026-106602Authentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack allows Password Recovery Exploitation.This issue affects Jetpack: from n/a through 16.2.
- 5.4MediumOct 9, 2026Automattic Jetpack Auth bypass / access controlCVE-2026-106601Authentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack allows Password Recovery Exploitation.This issue affects Jetpack: from n/a through 16.2.
- 6.9MediumOct 6, 2026Automattic WordPress Information disclosureCVE-2026-66666Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data. This issue affects WordPress: from 7.1 through 7.1.2, from 7.0 through 7.0.6, from 6.9 through 6.9.9, from 6.8 through 6.8.10, from 6.7 through 6.7.9, and from 6.6 through 6.6.9.
- 7.1HighSep 18, 2026Automattic WordPress XSSCVE-2026-93485Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WordPress wordpress allows DOM-Based XSS.This issue affects WordPress: from n/a through 7.1.Exploit codeNucleiDetection
- 7.5HighSep 8, 2026Automattic WooCommerce Denial of serviceCVE-2026-48888Allocation of Resources Without Limits or Throttling vulnerability in Automattic WooCommerce allows HTTP DoS. This issue affects WooCommerce: from n/a before 11.1.0.
- 7.6HighSep 4, 2026Automattic WooCommerce SQL injectionCVE-2026-57777Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Automattic WooCommerce allows Blind SQL Injection. This issue affects WooCommerce: from n/a before 11.0.
- 7.5HighApr 8, 2026Automattic activitypubCVE-2026-4338The ActivityPub WordPress plugin before 8.0.2 does not properly filter posts to be displayed, allowed unauthenticated users to access drafts/scheduled/pending posts
- 6.1MediumJan 13, 2026Automattic jetpack XSSCVE-2023-54332Jetpack 11.4 contains a cross-site scripting vulnerability in the contact form module that allows attackers to inject malicious scripts through the post_id parameter. Attackers can craft malicious URLs with script payloads to execute arbitrary JavaScript in victims' browsers when they interact with the contact form page.
Top products
- WooCommerce3 CVEs in the last year
- Jetpack3 CVEs in the last year
- WordPress2 CVEs in the last year
- Sensei LMS2 CVEs in the last year
- Jetpack VideoPress1 CVE in the last year
- activitypub1 CVE in the last year
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.