CVEs we hold for Automattic
Records whose assigning authority named Automattic as the affected vendor. Newest identifiers first, capped at 200.
CVE-2026-93485WordPress core <= 7.1 - Unauth. Cross Site Scripting (XSS) vulnerabilityAutomattic WordPress
CVE-2026-73562Mongoose: Prototype pollution in the update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)Automattic mongoose
CVE-2026-57777WordPress WooCommerce plugin < 11.0 - SQL Injection vulnerabilityAutomattic WooCommerce
CVE-2026-48888WordPress WooCommerce plugin < 11.1.0 - Denial of Service Attack vulnerabilityAutomattic WooCommerce
CVE-2026-42334Mongoose: Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL InjectionAutomattic mongoose
CVE-2026-25404WordPress WP Job Manager plugin <= 2.4.0 - Broken Access Control vulnerabilityAutomattic WP Job Manager
CVE-2026-22356WordPress Jetpack CRM plugin <= 6.7.0 - Local File Inclusion vulnerabilityAutomattic Jetpack CRM
CVE-2025-69015WordPress Crowdsignal Forms plugin <= 1.7.2 - Broken Access Control vulnerabilityAutomattic Crowdsignal Forms
CVE-2025-57924WordPress Developer Plugin <= 1.2.6 - Cross Site Request Forgery (CSRF) VulnerabilityAutomattic Developer
CVE-2025-49325WordPress Newspack Newsletters plugin <= 3.13.0 - Open Redirection VulnerabilityAutomattic Newspack Newsletters
CVE-2025-49042WordPress WooCommerce plugin <= 10.0.2 - Cross Site Scripting (XSS) vulnerabilityAutomattic WooCommerce
CVE-2025-26762WordPress WooCommerce plugin <= 9.7.0 - Cross Site Scripting (XSS) vulnerabilityAutomattic WooCommerce
CVE-2025-22740WordPress Sensei LMS plugin <= 4.24.4 - Broken Access Control vulnerabilityAutomattic Sensei LMS
CVE-2024-56006WordPress Jetpack Debug Tools plugin < 2.0.1 - Broken Access Control vulnerabilityAutomattic Jetpack Debug Tools
CVE-2024-43968WordPress Newspack plugin < 3.8.7 - Broken Access Control vulnerabilityAutomattic Newspack
CVE-2024-43949WordPress GHActivity plugin <= 2.0.0-alpha - Cross Site Scripting (XSS) vulnerabilityAutomattic GHActivity
CVE-2024-4392Jetpack – WP Security, Backup, Speed, & Growth <= 13.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via…automattic Jetpack – WP Security, Backup, Speed, & Growth
CVE-2024-43338WordPress Crowdsignal Polls & Ratings plugin <= 3.1.3 - Cross Site Request Forgery (CSRF) vulnerabilityAutomattic Crowdsignal Dashboard – Polls, Surveys & more
CVE-2024-39666WordPress WooCommerce plugin <= 9.1.2 - Cross Site Scripting (XSS) vulnerabilityAutomattic WooCommerce
CVE-2024-37477WordPress Newspack Content Converter plugin <= 0.1.5 - Broken Access Control vulnerabilityAutomattic Newspack Content Converter
CVE-2024-37476WordPress Newspack Campaigns plugin <= 2.31.1 - Cross Site Scripting (XSS) vulnerabilityAutomattic Newspack Campaigns
CVE-2024-37475WordPress Newspack Newsletters plugin <= 2.13.2 - Broken Access Control vulnerabilityAutomattic Newspack Newsletters
CVE-2024-37474WordPress Newspack Ads plugin <= 1.47.1 - Cross Site Scripting (XSS) vulnerabilityAutomattic Newspack Ads
CVE-2024-37443WordPress WP Job Manager plugin <= 2.1.0 - Broken Access Control vulnerabilityAutomattic WP Job Manager - Resume Manager
CVE-2024-37425WordPress Newspack Blocks plugin <= 3.0.8 - Broken Access Control vulnerabilityAutomattic Newspack Blocks
CVE-2024-37424WordPress Newspack Blocks plugin <= 3.0.8 - Arbitrary File Upload vulnerabilityAutomattic Newspack Blocks
CVE-2024-37423WordPress Newspack Blocks plugin <= 3.0.8 - Contributor+ Arbitrary Directory Deletion vulnerabilityAutomattic Newspack Blocks
CVE-2024-37242WordPress Newspack Newsletters plugin <= 2.13.2 - Cross Site Request Forgery (CSRF) vulnerabilityAutomattic Newspack Newsletters
CVE-2024-37241WordPress WP Job Manager Resume Manager plugin <= 2.1.0 - Cross Site Request Forgery (CSRF) vulnerabilityAutomattic WP Job Manager - Resume Manager
CVE-2024-37115WordPress Newspack Blocks plugin <= 3.0.8 - Sensitive Data Exposure vulnerabilityAutomattic Newspack Blocks
CVE-2024-35777WordPress WooCommerce plugin <= 8.9.2 - Content Injection vulnerabilityAutomattic WooCommerce
CVE-2024-35686WordPress Sensei LMS plugin <= 4.23.1 - Broken Access Control vulnerabilityAutomattic Sensei Pro (WC Paid Courses)
CVE-2024-34766WordPress ChaosTheory theme <= 1.3 - Cross Site Scripting (XSS) vulnerabilityAutomattic ChaosTheory
CVE-2024-34549WordPress WP Job Manager plugin <= 2.2.2 - Sensitive Data Exposure vulnerabilityAutomattic WP Job Manager
CVE-2024-32111WordPress core < 6.5.5 - Auth. Arbitrary .html File Read (Windows Only) vulnerabilityAutomattic WordPress
CVE-2024-22155WordPress WooCommerce plugin <= 8.5.2 - Cross Site Request Forgery (CSRF) vulnerabilityAutomattic WooCommerce
CVE-2023-52222WordPress WooCommerce Plugin <= 8.2.2 is vulnerable to Cross Site Request Forgery (CSRF)Automattic WooCommerce
CVE-2023-52212WordPress WP Job Manager plugin <= 2.0.0 - Cross Site Request Forgery (CSRF) vulnerabilityAutomattic WP Job Manager
CVE-2023-52211WordPress WP Job Manager plugin <= 2.0.0 - Broken Access Control vulnerabilityAutomattic WP Job Manager
CVE-2023-51503WordPress WooCommerce Payments Plugin <= 6.6.2 is vulnerable to Insecure Direct Object References (IDOR)Automattic WooPayments – Fully Integrated Solution Built…
CVE-2023-51489WordPress Crowdsignal Polls & Ratings plugin <= 3.0.11 - Cross Site Request Forgery (CSRF) vulnerabilityAutomattic, Inc. Crowdsignal Dashboard – Polls, Surveys &…
CVE-2023-51488WordPress Crowdsignal Dashboard – Polls, Surveys & more Plugin <= 3.0.11 is vulnerable to Cross Site Scripting (XSS)Automattic, Inc. Crowdsignal Dashboard – Polls, Surveys &…
CVE-2023-50879WordPress WordPress.com Editing Toolkit Plugin <= 3.78784 is vulnerable to Cross Site Scripting (XSS)Automattic WordPress.com Editing Toolkit
CVE-2023-50875WordPress Sensei LMS Plugin <= 4.17.0 is vulnerable to Cross Site Scripting (XSS)Automattic Sensei LMS – Online Courses, Quizzes, & Learning
CVE-2023-49828WordPress WooCommerce Payments Plugin <= 6.4.2 is vulnerable to Cross Site Scripting (XSS)Automattic WooPayments – Fully Integrated Solution Built…
CVE-2023-47788WordPress Jetpack plugin < 12.7 - Contributor+ Broken Access Control vulnerabilityAutomattic Jetpack
CVE-2023-47777WordPress WooCommerce and WooCommerce Blocks plugins - Auth. Cross-Site Scripting (XSS) vulnerabilityAutomattic WooCommerce Blocks
CVE-2023-47774WordPress Jetpack plugin < 12.7 - Auth. Iframe Injection vulnerabilityAutomattic Jetpack
CVE-2023-45050WordPress Jetpack Plugin <= 12.8-a.1 is vulnerable to Cross Site Scripting (XSS)Automattic Jetpack – WP Security, Backup, Speed, & Growth
CVE-2023-35916WordPress WooCommerce Payments Plugin <= 5.9.0 is vulnerable to Insecure Direct Object References (IDOR)Automattic WooPayments – Fully Integrated Solution Built…
CVE-2023-35915WordPress WooCommerce Payments Plugin <= 5.9.0 is vulnerable to SQL InjectionAutomattic WooPayments – Fully Integrated Solution Built…
CVE-2023-27429WordPress Jetpack CRM Plugin <= 5.4.4 is vulnerable to Cross Site Scripting (XSS)Automattic - Jetpack CRM team Jetpack CRM
CVE-2023-1912Limit Login Attempts <= 1.7.1 - Unauthenticated Stored Cross-Site Scriptingautomattic Limit Login Attempts
CVE-2022-45069WordPress Crowdsignal Dashboard plugin <= 3.0.9 - Privilege Escalation vulnerabilityAutomattic, Inc. Crowdsignal Dashboard – Polls, Surveys &…
CVE-2022-3342Jetpack CRM <= 5.3.1 - Cross-Site Request Forgery and PHAR Deserializationautomattic Jetpack CRM – Clients, Leads, Invoices, Billing…
CVE-2021-24374Jetpack < 9.8 - Carousel Module Non-Published Page/Post Attachment Comment LeakAutomattic Jetpack – WP Security, Backup, Speed, & Growth
CVE-2021-24323Woocommerce < 5.2.0 - Authenticated Stored Cross-Site Scripting (XSS)Automattic WooCommerce
67 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.
Everything on this page is free. Public data. Withholding it protects nothing.