Vulnerabilities in automattic
76 resultsCVE-2023-54332MEDIUMJetpack 11.4 - Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-35777LOWWordPress WooCommerce plugin <= 8.9.2 - Content Injection vulnerabilityEPSS 0.4%CVE-2025-49325MEDIUMWordPress Newspack Newsletters plugin <= 3.13.0 - Open Redirection VulnerabilityEPSS 0.3%CVE-2024-31111MEDIUMWordPress Core < 6.5.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-125116MEDIUMMongoose: Discriminator key values matching inherited properties (e.g. __t: 'constructor') bypass schema casting and can poison collectionsEPSS 0.3%CVE-2024-37443MEDIUMWordPress WP Job Manager plugin <= 2.1.0 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2023-50875MEDIUMWordPress Sensei LMS Plugin <= 4.17.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2023-7320MEDIUMWooCommerce <= 7.8.2 - Sensitive Information ExposureEPSS 0.3%CVE-2025-15033MEDIUMWooCommerce - Subscriber/Customer+ Order Data DisclosureEPSS 0.3%CVE-2024-56006MEDIUMWordPress Jetpack Debug Tools plugin < 2.0.1 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2023-50879MEDIUMWordPress WordPress.com Editing Toolkit Plugin <= 3.78784 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2025-22740MEDIUMWordPress Sensei LMS plugin <= 4.24.4 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-37474MEDIUMWordPress Newspack Ads plugin <= 1.47.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-37476MEDIUMWordPress Newspack Campaigns plugin <= 2.31.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-106608HIGHWordPress WooCommerce plugin 9.8.0-11.1.2 - Shop Manager+ Privilege Escalation vulnerabilityEPSS 0.3%CVE-2023-47774MEDIUMWordPress Jetpack plugin < 12.7 - Auth. Iframe Injection vulnerabilityEPSS 0.3%CVE-2023-52222MEDIUMWordPress WooCommerce Plugin <= 8.2.2 is vulnerable to Cross Site Request Forgery (CSRF)EPSS 0.3%CVE-2026-40808MEDIUMWordPress Jetpack VideoPress plugin <= 3.6 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-42334HIGHMongoose: Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL InjectionEPSS 0.3%CVE-2026-25404MEDIUMWordPress WP Job Manager plugin <= 2.4.0 - Broken Access Control vulnerabilityEPSS 0.3%