---
title: "Automattic vulnerabilities: CVEs, CISA KEV and security advisories"
url: https://radicalnotion.ai/vendor/automattic
type: vendor
description: "Automattic has 133 published CVEs, 0 in CISA KEV and 46 with public exploits."
updated: 2026-10-19
source: RadicalNotion.AI
license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/)
---

# Automattic vulnerabilities

- **Published CVEs:** 133
- **In CISA KEV:** 0
- **With a public exploit:** 46
- **With a patch:** 126
- **Average CVSS:** 6.5
- **CVEs in the last two years:** 40
- **First CVE:** 2011-12-02
- **Latest CVE:** 2026-10-19

## Severity breakdown

| Severity | CVEs |
| --- | --- |
| Critical | 11 |
| High | 39 |
| Medium | 81 |
| Low | 2 |
| Unscored | 0 |

## Most affected products

| Product | CVEs |
| --- | --- |
| [Jetpack](https://radicalnotion.ai/vendor/automattic/jetpack) | 20 |
| [WooCommerce](https://radicalnotion.ai/vendor/automattic/woocommerce) | 19 |
| [Sensei LMS](https://radicalnotion.ai/vendor/automattic/sensei-lms) | 10 |
| [mongoose](https://radicalnotion.ai/vendor/automattic/mongoose) | 7 |
| [sensei](https://radicalnotion.ai/vendor/automattic/sensei) | 6 |
| [WordPress](https://radicalnotion.ai/vendor/automattic/wordpress) | 6 |
| [activitypub](https://radicalnotion.ai/vendor/automattic/activitypub) | 6 |
| [WP Super Cache](https://radicalnotion.ai/vendor/automattic/wp-super-cache) | 6 |

## Most common weakness types

| CWE | Name | CVEs |
| --- | --- | --- |
| [CWE-79](https://radicalnotion.ai/cwe/cwe-79) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 38 |
| [CWE-862](https://radicalnotion.ai/cwe/cwe-862) | Missing Authorization | 17 |
| [CWE-352](https://radicalnotion.ai/cwe/cwe-352) | Cross-Site Request Forgery (CSRF) | 11 |
| [CWE-639](https://radicalnotion.ai/cwe/cwe-639) | Authorization Bypass Through User-Controlled Key | 10 |
| [CWE-89](https://radicalnotion.ai/cwe/cwe-89) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 5 |
| [CWE-94](https://radicalnotion.ai/cwe/cwe-94) | Improper Control of Generation of Code ('Code Injection') | 4 |
| [CWE-200](https://radicalnotion.ai/cwe/cwe-200) | Exposure of Sensitive Information to an Unauthorized Actor | 4 |
| [CWE-22](https://radicalnotion.ai/cwe/cwe-22) | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 3 |

## Assigning CNAs

| CNA | CVEs |
| --- | --- |
| [Patchstack](https://radicalnotion.ai/cna/patchstack) | 66 |
| [WPScan](https://radicalnotion.ai/cna/wpscan) | 29 |
| [mitre](https://radicalnotion.ai/cna/mitre) | 13 |
| [Wordfence](https://radicalnotion.ai/cna/wordfence) | 7 |
| [redhat](https://radicalnotion.ai/cna/redhat) | 5 |
| [VulnCheck](https://radicalnotion.ai/cna/vulncheck) | 4 |
| [GitHub\_M](https://radicalnotion.ai/cna/github-m) | 3 |
| [VulDB](https://radicalnotion.ai/cna/vuldb) | 2 |

## CVEs by year

| Year | CVEs published |
| --- | --- |
| 2019 | 6 |
| 2020 | 5 |
| 2021 | 6 |
| 2022 | 7 |
| 2023 | 25 |
| 2024 | 38 |
| 2025 | 21 |
| 2026 | 19 |

## Latest CVEs

| CVE | Title | Severity | CVSS | EPSS | CISA KEV | Published |
| --- | --- | --- | --- | --- | --- | --- |
| CVE-2026-112329 | Sensei LMS 4.26.4 Broken Access Control via save\_new\_message | medium | 5.3 | 0.2% | No | 2026-10-19 |
| CVE-2026-112328 | Sensei LMS 4.26.4 Broken Access Control via add\_new\_module\_term AJAX | medium | 5.3 | 0.2% | No | 2026-10-19 |
| CVE-2026-40808 | WordPress Jetpack VideoPress plugin \<= 3.6 - Broken Access Control vulnerability | medium | 6.5 | 0.3% | No | 2026-10-10 |
| CVE-2026-106608 | WordPress WooCommerce plugin 9.8.0-11.1.2 - Shop Manager+ Privilege Escalation vulnerability | high | 7.2 | 0.3% | No | 2026-10-10 |
| CVE-2026-106601 | WordPress Jetpack plugin \<= 16.2 - Broken Authentication vulnerability | medium | 5.4 | 0.2% | No | 2026-10-09 |
| CVE-2026-106602 | WordPress Jetpack plugin \<= 16.2 - Broken Authentication vulnerability | medium | 4.8 | 0.2% | No | 2026-10-09 |
| CVE-2026-66666 | WordPress Core \<= 7.1.2 - Unauthenticated Sensitive Data Exposure of Comments on Private and Unpublished Posts via Comment Feed vulnerability | medium | 6.9 | 0.4% | No | 2026-10-06 |
| CVE-2026-93485 | WordPress Core \<= 7.1 - Cross Site Scripting (XSS) vulnerability | high | 7.1 | 0.8% | No | 2026-09-18 |
| CVE-2026-48888 | WordPress WooCommerce plugin \< 11.1.0 - Denial of Service Attack vulnerability | high | 7.5 | 0.5% | No | 2026-09-08 |
| CVE-2026-57777 | WordPress WooCommerce plugin \< 11.0 - SQL Injection vulnerability | high | 7.6 | 0.4% | No | 2026-09-04 |
| CVE-2026-73562 | Mongoose: Prototype pollution in the update casting via \_\_proto\_\_-prefixed dotted path (Schema.\_getSchema/path getter) | medium | 6.5 | 0.5% | No | 2026-08-13 |
| CVE-2026-42334 | Mongoose: Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection | high | 7.5 | 0.3% | No | 2026-05-14 |

## Frequently asked questions

### How many CVEs does Automattic have?

Automattic has 133 published CVE records since 2011, including 40 in the last two years.

### How many Automattic CVEs are in CISA KEV?

None of Automattic's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

### Which Automattic products have the most CVEs?

The Automattic products with the most published CVEs are Jetpack, WooCommerce, Sensei LMS, mongoose, sensei.

### What are the most common weakness types in Automattic CVEs?

Automattic's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-862 (Missing Authorization), CWE-352 (Cross-Site Request Forgery (CSRF)), CWE-639 (Authorization Bypass Through User-Controlled Key).

### Are there public exploits for Automattic vulnerabilities?

Yes — 46 of Automattic's CVEs have a known public exploit.

### How many critical Automattic vulnerabilities are there?

Automattic has 11 critical and 39 high-severity CVEs.

### What is the average severity of Automattic CVEs?

The average CVSS base score across Automattic's scored CVEs is 6.5.

## Related vendors

- [WebKitGTK](https://radicalnotion.ai/vendor/webkitgtk) (135 CVEs)
- [Motorola](https://radicalnotion.ai/vendor/motorola) (134 CVEs)
- [Checkmk](https://radicalnotion.ai/vendor/checkmk) (134 CVEs)
- [Codepeople](https://radicalnotion.ai/vendor/codepeople) (134 CVEs)
- [ManageEngine](https://radicalnotion.ai/vendor/manageengine) (134 CVEs)
- [Honeywell](https://radicalnotion.ai/vendor/honeywell) (133 CVEs)
- [Puppet](https://radicalnotion.ai/vendor/puppet) (132 CVEs)
- [RealMag777](https://radicalnotion.ai/vendor/realmag777) (132 CVEs)

---

Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/automattic). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.