← Back

Automattic

automattic

74 CVEs • 30 products

Products (30)

Click to collapse
Toggle
Jetpack
jetpack
16 CVEs
Wp Super Cache
wp_super_cache
6 CVEs
Sensei Lms
sensei_lms
6 CVEs
Woopayments
woopayments
5 CVEs
Activitypub
activitypub
5 CVEs
Crowdsignal Dashboard
crowdsignal_dashboard
4 CVEs
Jetpack Crm
jetpack_crm
4 CVEs
Woocommerce
woocommerce
3 CVEs
Mailpoet
mailpoet
3 CVEs
Camptix Event Ticketing
camptix_event_ticketing
2 CVEs
Woocommerce Blocks
woocommerce_blocks
2 CVEs
Vaultpress
vaultpress
2 CVEs
Woocommerce Bookings
woocommerce_bookings
2 CVEs
Jetpack Boost
jetpack_boost
2 CVEs
Genericons
genericons
1 CVE
Akismet
akismet
1 CVE
W3 Super Cache
w3_super_cache
1 CVE
Canvas
canvas
1 CVE
Woocommerce Payments
woocommerce_payments
1 CVE
Canada Post Shipping Method
canada_post_shipping_method
1 CVE
Woocommerce Gocardless
woocommerce_gocardless
1 CVE
Woocommerce Square
woocommerce_square
1 CVE
Woocommerce Subscriptions
woocommerce_subscriptions
1 CVE
Wordpress.com Editing Toolkit
wordpress.com_editing_toolkit
1 CVE
Woocommerce Stripe
woocommerce_stripe
1 CVE
Newspack Popups
newspack_popups
1 CVE
Newspack Ads
newspack_ads
1 CVE
Ghacitivity
ghacitivity
1 CVE
Ghactivity
ghactivity
1 CVE
Newspack
newspack
1 CVE

CVEs (74)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2023-51489
1Automattic
1Crowdsignal Dashboard
Apr 28, 2026
Mar 16, 2024
N/A· v4
8.8 HIGH· v3
N/A· v2
Cross-Site Request Forgery (CSRF) vulnerability in Automattic, Inc. Crowdsignal Dashboard – Polls, Surveys & more.This issue affects Crowdsignal Dashboard – Polls, Surveys & more: from n/a through 3.0.11.
CVE-2023-50875
1Automattic
1Sensei Lms
Apr 28, 2026
Feb 12, 2024
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic Sensei LMS – Online Courses, Quizzes, & Learning allows Stored XSS.This issue affects Sensei LMS – Online C...Show more
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic Sensei LMS – Online Courses, Quizzes, & Learning allows Stored XSS.This issue affects Sensei LMS – Online Courses, Quizzes, & Learning: from n/a through 4.17.0.Show less
CVE-2023-51488
1Automattic
1Crowdsignal Dashboard
Apr 28, 2026
Feb 10, 2024
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic, Inc. Crowdsignal Dashboard – Polls, Surveys & more allows Reflected XSS.This issue affects Crowdsignal Das...Show more
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic, Inc. Crowdsignal Dashboard – Polls, Surveys & more allows Reflected XSS.This issue affects Crowdsignal Dashboard – Polls, Surveys & more: from n/a through 3.0.11.Show less
CVE-2023-51502
1Automattic
1Woocommerce Stripe
Apr 28, 2026
Jan 5, 2024
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce WooCommerce Stripe Payment Gateway.This issue affects WooCommerce Stripe Payment Gateway: from n/a through 7.6.1.
CVE-2023-51503
1Automattic
1Woopayments
Apr 28, 2026
Dec 31, 2023
N/A· v4
7.5 HIGH· v3
N/A· v2
Authorization Bypass Through User-Controlled Key vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo.This issue affects WooPayments – Fully Integrated Solution Built and Support...Show more
Authorization Bypass Through User-Controlled Key vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo.This issue affects WooPayments – Fully Integrated Solution Built and Supported by Woo: from n/a through 6.9.2.Show less
CVE-2023-50879
1Automattic
1Wordpress.com Editing Toolkit
Apr 28, 2026
Dec 29, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WordPress.Com Editing Toolkit allows Stored XSS.This issue affects WordPress.Com Editing Toolkit: from n/a...Show more
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WordPress.Com Editing Toolkit allows Stored XSS.This issue affects WordPress.Com Editing Toolkit: from n/a through 3.78784.Show less
CVE-2023-32747
1Automattic
1Woocommerce Bookings
Apr 28, 2026
Dec 21, 2023
N/A· v4
7.5 HIGH· v3
N/A· v2
Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce WooCommerce Bookings.This issue affects WooCommerce Bookings: from n/a through 1.15.78.
CVE-2023-35916
1Automattic
1Woopayments
Apr 28, 2026
Dec 20, 2023
N/A· v4
7.5 HIGH· v3
N/A· v2
Authorization Bypass Through User-Controlled Key vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo.This issue affects WooPayments – Fully Integrated Solution Built and Support...Show more
Authorization Bypass Through User-Controlled Key vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo.This issue affects WooPayments – Fully Integrated Solution Built and Supported by Woo: from n/a through 5.9.0.Show less
CVE-2023-35915
1Automattic
1Woopayments
Apr 28, 2026
Dec 20, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo.This issue affects WooPayments – Fully I...Show more
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo.This issue affects WooPayments – Fully Integrated Solution Built and Supported by Woo: from n/a through 5.9.0.Show less
CVE-2023-35914
1Automattic
1Woocommerce Subscriptions
Apr 28, 2026
Dec 20, 2023
N/A· v4
7.5 HIGH· v3
N/A· v2
Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce Woo Subscriptions.This issue affects Woo Subscriptions: from n/a through 5.1.2.
CVE-2023-35876
1Automattic
1Woocommerce Square
Apr 28, 2026
Dec 20, 2023
N/A· v4
8.1 HIGH· v3
N/A· v2
Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce WooCommerce Square.This issue affects WooCommerce Square: from n/a through 3.8.1.
CVE-2023-37871
1Automattic
1Woocommerce Gocardless
Apr 28, 2026
Dec 20, 2023
N/A· v4
7.5 HIGH· v3
N/A· v2
Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce GoCardless.This issue affects GoCardless: from n/a through 2.5.6.
CVE-2023-47789
1Automattic
1Canada Post Shipping Method
Apr 28, 2026
Dec 18, 2023
N/A· v4
8.8 HIGH· v3
N/A· v2
Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce Canada Post Shipping Method.This issue affects Canada Post Shipping Method: from n/a through 2.8.3.
CVE-2023-47787
1Automattic
1Woocommerce Bookings
Apr 28, 2026
Dec 18, 2023
N/A· v4
8.8 HIGH· v3
N/A· v2
Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce WooCommerce Bookings.This issue affects WooCommerce Bookings: from n/a through 2.0.3.
CVE-2023-49828
1Automattic
1Woopayments
Apr 28, 2026
Dec 14, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo allows Stored XSS.This issue affects Woo...Show more
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo allows Stored XSS.This issue affects WooPayments – Fully Integrated Solution Built and Supported by Woo: from n/a through 6.4.2.Show less
CVE-2023-47777
1Automattic
2Woocommerce
Woocommerce Blocks
Apr 28, 2026
Nov 30, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooCommerce, Automattic WooCommerce Blocks allows Stored XSS.This issue affects WooCommerce: from n/a throu...Show more
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooCommerce, Automattic WooCommerce Blocks allows Stored XSS.This issue affects WooCommerce: from n/a through 8.1.1; WooCommerce Blocks: from n/a through 11.1.1.Show less
CVE-2023-45050
1Automattic
1Jetpack
Apr 28, 2026
Nov 30, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic Jetpack – WP Security, Backup, Speed, & Growth allows Stored XSS.This issue affects Jetpack – WP Security,...Show more
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic Jetpack – WP Security, Backup, Speed, & Growth allows Stored XSS.This issue affects Jetpack – WP Security, Backup, Speed, & Growth: from n/a through 12.8-a.1.Show less
CVE-2022-3342
1Automattic
1Jetpack Crm
Apr 8, 2026
Oct 20, 2023
N/A· v4
8.8 HIGH· v3
N/A· v2
The Jetpack CRM plugin for WordPress is vulnerable to PHAR deserialization via the ‘zbscrmcsvimpf’ parameter in the 'zeroBSCRM_CSVImporterLitehtml_app' function in versions up to, and including, 5.3.1. While the function...Show more
The Jetpack CRM plugin for WordPress is vulnerable to PHAR deserialization via the ‘zbscrmcsvimpf’ parameter in the 'zeroBSCRM_CSVImporterLitehtml_app' function in versions up to, and including, 5.3.1. While the function performs a nonce check, steps 2 and 3 of the check do not take any action upon a failed check. These steps then perform a 'file_exists' check on the value of 'zbscrmcsvimpf'. If a phar:// archive is supplied, its contents will be deserialized and an object injected in the execution stream. This allows an unauthenticated attacker to obtain object injection if they are able to upload a phar archive (for instance if the site supports image uploads) and then trick an administrator into performing an action, such as clicking a link.Show less
CVE-2023-5057
1Automattic
1Activitypub
Nov 21, 2024
Oct 16, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
The ActivityPub WordPress plugin before 1.0.0 does not escape user metadata before outputting them in mentions, which could allow users with a role of Contributor and above to perform Stored XSS attacks
CVE-2023-3746
1Automattic
1Activitypub
Apr 23, 2025
Oct 16, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
The ActivityPub WordPress plugin before 1.0.0 does not sanitize and escape some data from post content, which could allow contributor and above role to perform Stored Cross-Site Scripting attacks