Skip to content
OpenAdvisories

Vendor

Automattic

79 known vulnerabilities.

Products

WooCommerce 17 mongoose 7 Jetpack 5 Newspack Blocks 4 WordPress 4 WP Job Manager 4 Sensei LMS 4 WooPayments – Fully Integrated Solution Built and Supported by Woo 4 Crowdsignal Dashboard – Polls, Surveys & more 3 Newspack Newsletters 3 Jetpack – WP Security, Backup, Speed, & Growth 3 automattic/mongoose 2 WP Job Manager - Resume Manager 2 Jetpack VideoPress 1 Newspack Ads 1 Jetpack CRM 1 GHActivity 1 WP Super Cache 1 Newspack Content Converter 1 Crowdsignal Forms 1 Newspack 1 Newspack Campaigns 1 Crowdsignal Dashboard – Polls, Surveys & more (WordPress plugin) 1 Jetpack CRM – Clients, Leads, Invoices, Billing, Email Marketing, & Automation 1 Developer 1 Sensei Pro (WC Paid Courses) 1 ChaosTheory 1 Sensei LMS – Online Courses, Quizzes, & Learning 1 Limit Login Attempts 1 WordPress.com Editing Toolkit 1 Jetpack Debug Tools 1 WooCommerce Blocks 1
All Critical High Medium Low Exploited only Public exploit

56 results · Clear filters · Feed

  • Medium 6.4
    CVE-2024-4392

    Jetpack – WP Security, Backup, Speed, & Growth <= 13.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpvideo Shortcode

    The Jetpack – WP Security, Backup, Speed, & Growth plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpvideo shortcode in all versions up to, and including, 13.3.1 due to insufficient input sanitization and output escaping on …

    Automattic Jetpack – WP Security, Backup, Speed, & Growth Web / CMS
  • Medium 5.3
    CVE-2024-34549

    WordPress WP Job Manager plugin <= 2.2.2 - Sensitive Data Exposure vulnerability

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Automattic WP Job Manager.This issue affects WP Job Manager: from n/a through 2.2.2.

    Automattic WP Job Manager
  • Medium 5.4
    CVE-2023-47774

    WordPress Jetpack plugin < 12.7 - Auth. Iframe Injection vulnerability

    Improper Restriction of Rendered UI Layers or Frames vulnerability in Automattic Jetpack allows Clickjacking.This issue affects Jetpack: from n/a before 12.7.

    Automattic Jetpack
  • Medium 5.3
    CVE-2023-52211

    WordPress WP Job Manager plugin <= 2.0.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Automattic WP Job Manager.This issue affects WP Job Manager: from n/a through 2.0.0.

    Automattic WP Job Manager
  • Medium 4.3
    CVE-2024-22155

    WordPress WooCommerce plugin <= 8.5.2 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Automattic WooCommerce.This issue affects WooCommerce: from n/a through 8.5.2.

    Automattic WooCommerce Web / CMS
  • Medium 5.4
    CVE-2023-51489

    WordPress Crowdsignal Polls & Ratings plugin <= 3.0.11 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Automattic, Inc. Crowdsignal Dashboard – Polls, Surveys & more.This issue affects Crowdsignal Dashboard – Polls, Surveys & more: from n/a through 3.0.11.

    Automattic Crowdsignal Dashboard – Polls, Surveys & more
  • Medium 6.5
    CVE-2023-50875

    WordPress Sensei LMS Plugin <= 4.17.0 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic Sensei LMS – Online Courses, Quizzes, & Learning allows Stored XSS.This issue affects Sensei LMS – Online Courses, Quizzes, & Learning: from n/a t…

    Automattic Sensei LMS – Online Courses, Quizzes, & Learning
  • Medium 4.3
    CVE-2023-52222

    WordPress WooCommerce Plugin <= 8.2.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Automattic WooCommerce.This issue affects WooCommerce: from n/a through 8.2.2.

    Automattic WooCommerce Web / CMS
  • Medium 5.9
    CVE-2023-51503

    WordPress WooCommerce Payments Plugin <= 6.6.2 is vulnerable to Insecure Direct Object References (IDOR)

    Authorization Bypass Through User-Controlled Key vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo.This issue affects WooPayments – Fully Integrated Solution Built and Supported by Woo: from n/a through 6.9.2.

    Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo
  • Medium 6.5
    CVE-2023-50879

    WordPress WordPress.com Editing Toolkit Plugin <= 3.78784 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WordPress.Com Editing Toolkit allows Stored XSS.This issue affects WordPress.Com Editing Toolkit: from n/a through 3.78784.

    Automattic WordPress.com Editing Toolkit Web / CMS
  • Medium 6.5
    CVE-2023-49828

    WordPress WooCommerce Payments Plugin <= 6.4.2 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo allows Stored XSS.This issue affects WooPayments – Fully Integrated Solution Bu…

    Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo
  • Medium 6.5
    CVE-2023-45050

    WordPress Jetpack Plugin <= 12.8-a.1 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic Jetpack – WP Security, Backup, Speed, & Growth allows Stored XSS.This issue affects Jetpack – WP Security, Backup, Speed, & Growth: from n/a throu…

    Automattic Jetpack – WP Security, Backup, Speed, & Growth
  • Medium 6.5
    CVE-2023-47777

    WordPress WooCommerce and WooCommerce Blocks plugins - Auth. Cross-Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooCommerce, Automattic WooCommerce Blocks allows Stored XSS.This issue affects WooCommerce: from n/a through 8.1.1; WooCommerce Blocks: from n/a …

    Automattic WooCommerce WooCommerce Blocks Web / CMS
  • Medium 6.3
    CVE-2022-45069

    WordPress Crowdsignal Dashboard plugin <= 3.0.9 - Privilege Escalation vulnerability

    Auth. (contributor+) Privilege Escalation vulnerability in Crowdsignal Dashboard plugin <= 3.0.9 on WordPress.

    Automattic Crowdsignal Dashboard – Polls, Surveys & more (WordPress plugin) Web / CMS
  • Medium 5.3
    CVE-2021-24374

    Jetpack < 9.8 - Carousel Module Non-Published Page/Post Attachment Comment Leak

    The Jetpack Carousel module of the JetPack WordPress plugin before 9.8 allows users to create a "carousel" type image gallery and allows users to comment on the images. A security vulnerability was found within the Jetpack Carousel module by nguyenhg_vcs that…

    Automattic Jetpack – WP Security, Backup, Speed, & Growth automattic/jetpack Web / CMS Packagist
  • Medium 4.8
    CVE-2021-24323

    Woocommerce < 5.2.0 - Authenticated Stored Cross-Site Scripting (XSS)

    When taxes are enabled, the "Additional tax classes" field was not properly sanitised or escaped before being output back in the admin dashboard, allowing high privilege users such as admin to use XSS payloads even when the unfiltered_html is disabled

    Automattic WooCommerce woocommerce/woocommerce Web / CMS Packagist