automattic vulnerabilities

CVEs per yearBy the year they were published

1. 20213
2. 20221
3. 202310
4. 202427
5. 202512
6. 202617

Newest CVEs

• CVE-2026-112329

  Sensei LMS 4.26.4 Broken Access Control via save_new_message

  Automattic · Sensei LMS

  Medium5.3
• CVE-2026-112328

  Sensei LMS 4.26.4 Broken Access Control via add_new_module_term AJAX

  Automattic · Sensei LMS

  Medium5.3
• CVE-2026-40808

  WordPress Jetpack VideoPress plugin <= 3.6 - Broken Access Control vulnerability

  Automattic · Jetpack VideoPress

  Medium6.5
• CVE-2026-106608

  WordPress WooCommerce plugin 9.8.0-11.1.2 - Shop Manager+ Privilege Escalation vulnerability

  Automattic · WooCommerce

  High7.2
• CVE-2026-106601

  WordPress Jetpack plugin <= 16.2 - Broken Authentication vulnerability

  Automattic · Jetpack

  Medium5.4
• CVE-2026-106602

  WordPress Jetpack plugin <= 16.2 - Broken Authentication vulnerability

  Automattic · Jetpack

  Medium4.8
• CVE-2026-66666

  WordPress Core <= 7.1.2 - Unauthenticated Sensitive Data Exposure of Comments on Private and Unpublished Posts via Comment Feed vulnerability

  Automattic · WordPress

  Medium6.9
• CVE-2026-93485

  WordPress Core <= 7.1 - Cross Site Scripting (XSS) vulnerability

  Automattic · WordPress

  High7.1
• CVE-2026-48888

  WordPress WooCommerce plugin < 11.1.0 - Denial of Service Attack vulnerability

  Automattic · WooCommerce

  High7.5
• CVE-2026-57777

  WordPress WooCommerce plugin < 11.0 - SQL Injection vulnerability

  Automattic · WooCommerce

  High7.6