# cve.now: Automattic

The newest entries naming Automattic as an affected vendor (up to 200), of 78 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-125120](https://cve.now/CVE-2026-125120.md): Mongoose: sanitizeFilter not applied on countDocuments (CVSS 9.8)
- [CVE-2026-125119](https://cve.now/CVE-2026-125119.md): Mongoose: Connection-level sanitizeFilter not applied (CVSS 7.5)
- [CVE-2026-125118](https://cve.now/CVE-2026-125118.md): Mongoose: Prototype pollution via Schema.prototype.virtual() (CVSS 6.5)
- [CVE-2026-125117](https://cve.now/CVE-2026-125117.md): Mongoose walks into inherited properties when hydrating, setting, and merging, allowing overwrites of built-in functions (denial of… (CVSS 8.2)
- [CVE-2026-125116](https://cve.now/CVE-2026-125116.md): Mongoose: Discriminator key values matching inherited properties (e.g. \_\_t: 'constructor') bypass schema casting and can poison collections (CVSS 4.8)
- [CVE-2026-112329](https://cve.now/CVE-2026-112329.md): Sensei LMS 4.26.4 Broken Access Control via save\_new\_message (CVSS 5.3)
- [CVE-2026-112328](https://cve.now/CVE-2026-112328.md): Sensei LMS 4.26.4 Broken Access Control via add\_new\_module\_term AJAX (CVSS 5.3)
- [CVE-2026-40808](https://cve.now/CVE-2026-40808.md): WordPress Jetpack VideoPress plugin \<= 3.6 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2026-106608](https://cve.now/CVE-2026-106608.md): WordPress WooCommerce plugin 9.8.0-11.1.2 - Shop Manager+ Privilege Escalation vulnerability (CVSS 7.2)
- [CVE-2026-106601](https://cve.now/CVE-2026-106601.md): WordPress Jetpack plugin \<= 16.2 - Broken Authentication vulnerability (CVSS 5.4)
- [CVE-2026-106602](https://cve.now/CVE-2026-106602.md): WordPress Jetpack plugin \<= 16.2 - Broken Authentication vulnerability (CVSS 4.8)
- [CVE-2026-66666](https://cve.now/CVE-2026-66666.md): WordPress Core \<= 7.1.2 - Unauthenticated Sensitive Data Exposure of Comments on Private and Unpublished Posts via Comment Feed vulnerability (CVSS 6.9)
- [CVE-2026-93485](https://cve.now/CVE-2026-93485.md): WordPress Core \<= 7.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-48888](https://cve.now/CVE-2026-48888.md): WordPress WooCommerce plugin \< 11.1.0 - Denial of Service Attack vulnerability (CVSS 7.5)
- [CVE-2026-57777](https://cve.now/CVE-2026-57777.md): WordPress WooCommerce plugin \< 11.0 - SQL Injection vulnerability (CVSS 7.6)
- [CVE-2026-73562](https://cve.now/CVE-2026-73562.md): Mongoose: Prototype pollution in the update casting via \_\_proto\_\_-prefixed dotted path (Schema.\_getSchema/path getter) (CVSS 6.5)
- [CVE-2026-42334](https://cve.now/CVE-2026-42334.md): Mongoose: Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection (CVSS 7.5)
- [CVE-2026-3589](https://cve.now/CVE-2026-3589.md): WooCommerce \< 10.5.3 - Arbitrary Admin User Creation via CSRF (CVSS 7.5)
- [CVE-2026-22356](https://cve.now/CVE-2026-22356.md): WordPress Jetpack CRM plugin \<= 6.7.0 - Local File Inclusion vulnerability (CVSS 7.5)
- [CVE-2026-25404](https://cve.now/CVE-2026-25404.md): WordPress WP Job Manager plugin \<= 2.4.0 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2023-54332](https://cve.now/CVE-2023-54332.md): Jetpack 11.4 - Cross Site Scripting (XSS) (CVSS 5.1)
- [CVE-2023-52212](https://cve.now/CVE-2023-52212.md): WordPress WP Job Manager plugin \<= 2.0.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4)
- [CVE-2025-69015](https://cve.now/CVE-2025-69015.md): WordPress Crowdsignal Forms plugin \<= 1.7.2 - Broken Access Control vulnerability (CVSS 3.8)
- [CVE-2025-15033](https://cve.now/CVE-2025-15033.md): WooCommerce - Subscriber/Customer+ Order Data Disclosure (CVSS 6.5)
- [CVE-2023-7320](https://cve.now/CVE-2023-7320.md): WooCommerce \<= 7.8.2 - Sensitive Information Exposure (CVSS 5.3)
- [CVE-2025-49042](https://cve.now/CVE-2025-49042.md): WordPress WooCommerce plugin \<= 10.0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2025-57924](https://cve.now/CVE-2025-57924.md): WordPress Developer Plugin \<= 1.2.6 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3)
- [CVE-2025-49325](https://cve.now/CVE-2025-49325.md): WordPress Newspack Newsletters plugin \<= 3.13.0 - Open Redirection Vulnerability (CVSS 4.7)
- [CVE-2025-5062](https://cve.now/CVE-2025-5062.md): WooCommerce \<= 9.4.2 - PostMessage-Based Cross-Site Scripting (CVSS 6.1)
- [CVE-2024-56006](https://cve.now/CVE-2024-56006.md): WordPress Jetpack Debug Tools plugin \< 2.0.1 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2025-22740](https://cve.now/CVE-2025-22740.md): WordPress Sensei LMS plugin \<= 4.24.4 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2025-26762](https://cve.now/CVE-2025-26762.md): WordPress WooCommerce plugin \<= 9.7.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2024-37241](https://cve.now/CVE-2024-37241.md): WordPress WP Job Manager Resume Manager plugin \<= 2.1.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2024-37242](https://cve.now/CVE-2024-37242.md): WordPress Newspack Newsletters plugin \<= 2.13.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2024-43338](https://cve.now/CVE-2024-43338.md): WordPress Crowdsignal Polls & Ratings plugin \<= 3.1.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2024-37423](https://cve.now/CVE-2024-37423.md): WordPress Newspack Blocks plugin \<= 3.0.8 - Contributor+ Arbitrary Directory Deletion vulnerability (CVSS 8.5)
- [CVE-2024-37425](https://cve.now/CVE-2024-37425.md): WordPress Newspack Blocks plugin \<= 3.0.8 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2024-37443](https://cve.now/CVE-2024-37443.md): WordPress WP Job Manager plugin \<= 2.1.0 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2024-37475](https://cve.now/CVE-2024-37475.md): WordPress Newspack Newsletters plugin \<= 2.13.2 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2024-37477](https://cve.now/CVE-2024-37477.md): WordPress Newspack Content Converter plugin \<= 0.1.5 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2024-43968](https://cve.now/CVE-2024-43968.md): WordPress Newspack plugin \< 3.8.7 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2024-9944](https://cve.now/CVE-2024-9944.md): WooCommerce \<= 9.0.2 - Unauthenticated HTML Injection (CVSS 5.3)
- [CVE-2024-43949](https://cve.now/CVE-2024-43949.md): WordPress GHActivity plugin \<= 2.0.0-alpha - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-35686](https://cve.now/CVE-2024-35686.md): WordPress Sensei LMS plugin \<= 4.23.1 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2024-39666](https://cve.now/CVE-2024-39666.md): WordPress WooCommerce plugin \<= 9.1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2024-37115](https://cve.now/CVE-2024-37115.md): WordPress Newspack Blocks plugin \<= 3.0.8 - Sensitive Data Exposure vulnerability (CVSS 7.5)
- [CVE-2024-37424](https://cve.now/CVE-2024-37424.md): WordPress Newspack Blocks plugin \<= 3.0.8 - Arbitrary File Upload vulnerability (CVSS 9.9)
- [CVE-2024-35777](https://cve.now/CVE-2024-35777.md): WordPress WooCommerce plugin \<= 8.9.2 - Content Injection vulnerability (CVSS 3.5)
- [CVE-2024-37474](https://cve.now/CVE-2024-37474.md): WordPress Newspack Ads plugin \<= 1.47.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-37476](https://cve.now/CVE-2024-37476.md): WordPress Newspack Campaigns plugin \<= 2.31.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-32111](https://cve.now/CVE-2024-32111.md): WordPress core \< 6.5.5 - Auth. Arbitrary .html File Read (Windows Only) vulnerability (CVSS 5.0)
- [CVE-2024-31111](https://cve.now/CVE-2024-31111.md): WordPress Core \< 6.5.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2023-47788](https://cve.now/CVE-2023-47788.md): WordPress Jetpack plugin \< 12.7 - Contributor+ Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2024-34766](https://cve.now/CVE-2024-34766.md): WordPress ChaosTheory theme \<= 1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-4392](https://cve.now/CVE-2024-4392.md): Jetpack – WP Security, Backup, Speed, & Growth \<= 13.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpvideo Shortcode (CVSS 6.4)
- [CVE-2024-34549](https://cve.now/CVE-2024-34549.md): WordPress WP Job Manager plugin \<= 2.2.2 - Sensitive Data Exposure vulnerability (CVSS 5.3)
- [CVE-2023-47774](https://cve.now/CVE-2023-47774.md): WordPress Jetpack plugin \< 12.7 - Auth. Iframe Injection vulnerability (CVSS 5.4)
- [CVE-2023-52211](https://cve.now/CVE-2023-52211.md): WordPress WP Job Manager plugin \<= 2.0.0 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2024-22155](https://cve.now/CVE-2024-22155.md): WordPress WooCommerce plugin \<= 8.5.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2023-51489](https://cve.now/CVE-2023-51489.md): WordPress Crowdsignal Polls & Ratings plugin \<= 3.0.11 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4)
- [CVE-2023-50875](https://cve.now/CVE-2023-50875.md): WordPress Sensei LMS Plugin \<= 4.17.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5)
- [CVE-2023-51488](https://cve.now/CVE-2023-51488.md): WordPress Crowdsignal Dashboard – Polls, Surveys & more Plugin \<= 3.0.11 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1)
- [CVE-2023-52222](https://cve.now/CVE-2023-52222.md): WordPress WooCommerce Plugin \<= 8.2.2 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3)
- [CVE-2023-51503](https://cve.now/CVE-2023-51503.md): WordPress WooCommerce Payments Plugin \<= 6.6.2 is vulnerable to Insecure Direct Object References (IDOR) (CVSS 5.9)
- [CVE-2023-50879](https://cve.now/CVE-2023-50879.md): WordPress WordPress.com Editing Toolkit Plugin \<= 3.78784 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5)
- [CVE-2023-35915](https://cve.now/CVE-2023-35915.md): WordPress WooCommerce Payments Plugin \<= 5.9.0 is vulnerable to SQL Injection (CVSS 7.6)
- [CVE-2023-35916](https://cve.now/CVE-2023-35916.md): WordPress WooCommerce Payments Plugin \<= 5.9.0 is vulnerable to Insecure Direct Object References (IDOR) (CVSS 7.5)
- [CVE-2023-49828](https://cve.now/CVE-2023-49828.md): WordPress WooCommerce Payments Plugin \<= 6.4.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5)
- [CVE-2023-45050](https://cve.now/CVE-2023-45050.md): WordPress Jetpack Plugin \<= 12.8-a.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5)
- [CVE-2023-47777](https://cve.now/CVE-2023-47777.md): WordPress WooCommerce and WooCommerce Blocks plugins - Auth. Cross-Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2022-3342](https://cve.now/CVE-2022-3342.md): Jetpack CRM \<= 5.3.1 - Cross-Site Request Forgery and PHAR Deserialization (CVSS 7.5)
- [CVE-2023-3696](https://cve.now/CVE-2023-3696.md): Prototype Pollution in automattic/mongoose (CVSS 10.0)
- [CVE-2023-1912](https://cve.now/CVE-2023-1912.md): Limit Login Attempts \<= 1.7.1 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2)
- [CVE-2022-45069](https://cve.now/CVE-2022-45069.md): WordPress Crowdsignal Dashboard plugin \<= 3.0.9 - Privilege Escalation vulnerability (CVSS 6.3)
- [CVE-2022-2564](https://cve.now/CVE-2022-2564.md): Prototype Pollution in automattic/mongoose (CVSS 7.0)
- [CVE-2021-24374](https://cve.now/CVE-2021-24374.md): Jetpack \< 9.8 - Carousel Module Non-Published Page/Post Attachment Comment Leak (no CVSS)
- [CVE-2021-24312](https://cve.now/CVE-2021-24312.md): WP Super Cache \< 1.7.3 - Authenticated Remote Code Execution (no CVSS)
- [CVE-2021-24323](https://cve.now/CVE-2021-24323.md): Woocommerce \< 5.2.0 - Authenticated Stored Cross-Site Scripting (XSS) (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/automattic
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.