Automattic vulnerabilities
78 CVEs and advisories name Automattic as an affected vendor, newest first. Follow it as a feed.
- CVE-2025-22740WordPress Sensei LMS plugin <= 4.24.4 - Broken Access Control vulnerability
- CVE-2025-26762WordPress WooCommerce plugin <= 9.7.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-37241WordPress WP Job Manager Resume Manager plugin <= 2.1.0 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-37242WordPress Newspack Newsletters plugin <= 2.13.2 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-43338WordPress Crowdsignal Polls & Ratings plugin <= 3.1.3 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-37423WordPress Newspack Blocks plugin <= 3.0.8 - Contributor+ Arbitrary Directory Deletion vulnerability
- CVE-2024-37425WordPress Newspack Blocks plugin <= 3.0.8 - Broken Access Control vulnerability
- CVE-2024-37443WordPress WP Job Manager plugin <= 2.1.0 - Broken Access Control vulnerability
- CVE-2024-37475WordPress Newspack Newsletters plugin <= 2.13.2 - Broken Access Control vulnerability
- CVE-2024-37477WordPress Newspack Content Converter plugin <= 0.1.5 - Broken Access Control vulnerability
- CVE-2024-43968WordPress Newspack plugin < 3.8.7 - Broken Access Control vulnerability
- CVE-2024-9944WooCommerce <= 9.0.2 - Unauthenticated HTML Injection
- CVE-2024-43949WordPress GHActivity plugin <= 2.0.0-alpha - Cross Site Scripting (XSS) vulnerability
- CVE-2024-35686WordPress Sensei LMS plugin <= 4.23.1 - Broken Access Control vulnerability
- CVE-2024-39666WordPress WooCommerce plugin <= 9.1.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-37115WordPress Newspack Blocks plugin <= 3.0.8 - Sensitive Data Exposure vulnerability
- CVE-2024-37424WordPress Newspack Blocks plugin <= 3.0.8 - Arbitrary File Upload vulnerability
- CVE-2024-35777WordPress WooCommerce plugin <= 8.9.2 - Content Injection vulnerability
- CVE-2024-37474WordPress Newspack Ads plugin <= 1.47.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-37476WordPress Newspack Campaigns plugin <= 2.31.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-32111WordPress core < 6.5.5 - Auth. Arbitrary .html File Read (Windows Only) vulnerability
- CVE-2024-31111WordPress Core < 6.5.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2023-47788WordPress Jetpack plugin < 12.7 - Contributor+ Broken Access Control vulnerability
- CVE-2024-34766WordPress ChaosTheory theme <= 1.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-4392Jetpack – WP Security, Backup, Speed, & Growth <= 13.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpvideo Shortcode
- CVE-2024-34549WordPress WP Job Manager plugin <= 2.2.2 - Sensitive Data Exposure vulnerability
- CVE-2023-47774WordPress Jetpack plugin < 12.7 - Auth. Iframe Injection vulnerability
- CVE-2023-52211WordPress WP Job Manager plugin <= 2.0.0 - Broken Access Control vulnerability
- CVE-2024-22155WordPress WooCommerce plugin <= 8.5.2 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2023-51489WordPress Crowdsignal Polls & Ratings plugin <= 3.0.11 - Cross Site Request Forgery (CSRF) vulnerability