Vendor
Automattic
125 known vulnerabilities in products by Automattic, 0 of them actively exploited (CISA KEV).
Key figures
125
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
9
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2023-28121 | WooCommerce Payments WordPress Plugin: Improper Authentication | 9.8 | |
| Critical | CVE-2013-2010 | W3 Total Cache Plugin: Code Execution | 9.8 | |
| High | CVE-2013-2009 | WP Super Cache Plugin: Code Execution | 8.8 | |
| High | CVE-2023-2996 | Jetpack < 12.1.1 - Author+ Arbitrary File Manipulation via API | 8.8 | |
| High | CVE-2017-17058 | Automattic WooCommerce: Path Traversal | 7.5 | |
| Critical | CVE-2022-2564 | Prototype Pollution in automattic/mongoose | 7.0 | |
| High | CVE-2021-24209 | WP Super Cache < 1.7.2 - Authenticated Remote Code Execution (RCE) | 7.2 | |
| High | CVE-2021-32789 | Woocommerce-gutenberg-products-block: SQL Injection | 7.5 | |
| High | CVE-2013-2011 | Super Cache Plugin: security vulnerability | 8.8 | |
| High | CVE-2020-8215 | Node-canvas: Classic Buffer Overflow | 8.8 | |
| Medium | CVE-2021-24329 | WP Super Cache < 1.7.3 - Authenticated Stored Cross-Site Scripting (XSS) | 5.4 | |
| Critical | CVE-2023-3696 | Prototype Pollution in automattic/mongoose | 10.0 | |
| High | CVE-2021-24312 | WP Super Cache < 1.7.3 - Authenticated Remote Code Execution | 7.2 | |
| Medium | CVE-2022-2034 | Sensei LMS < 4.5.0 - Unauthenticated Private Messages Disclosure via Rest API | 5.3 | |
| High | CVE-2016-10762 | Automattic CampTix Event Ticketing: security vulnerability | 7.5 | |
| High | CVE-2024-7786 | Sensei LMS < 4.24.2 - Unauthenticated Email Template Leak | 5.3 | |
| Medium | CVE-2019-11843 | MailPoet: Cross-Site Scripting (XSS) | 6.1 | |
| High | CVE-2026-48888 | WordPress WooCommerce plugin < 11.1.0 - Denial of Service Attack vulnerability | 7.5 | |
| Medium | CVE-2013-2008 | Super Cache Plugin: Cross-Site Scripting (XSS) | 6.1 | |
| Medium | CVE-2026-66666 | Automattic WordPress: Insertion of Sensitive Information Into Sent Data | — | |
| High | CVE-2026-57777 | WordPress WooCommerce plugin < 11.0 - SQL Injection vulnerability | 7.6 | |
| Critical | CVE-2024-37424 | WordPress Newspack Blocks plugin <= 3.0.8 - Arbitrary File Upload vulnerability | 9.9 | |
| Critical | CVE-2024-6584 | Jetpack Boost < 3.4.7 - Admin+ SSRF | 9.1 | |
| High | CVE-2026-93485 | WordPress Core <= 7.1 - Cross Site Scripting (XSS) vulnerability | 7.1 | |
| High | CVE-2022-3342 | Jetpack CRM <= 5.3.1 - Cross-Site Request Forgery and PHAR Deserialization | 7.5 |