---
title: "Automattic activitypub vulnerabilities and CVEs"
url: https://radicalnotion.ai/vendor/automattic/activitypub
type: product
description: "Automattic activitypub has 6 published CVEs, 0 in CISA KEV and 5 with public exploits."
updated: 2026-04-08
source: RadicalNotion.AI
license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/)
---

# Automattic activitypub vulnerabilities

Vendor: [Automattic](https://radicalnotion.ai/vendor/automattic)

- **Published CVEs:** 6
- **In CISA KEV:** 0
- **With a public exploit:** 5
- **With a patch:** 6
- **Average CVSS:** 5.6
- **First CVE:** 2023-10-16
- **Latest CVE:** 2026-04-08

## Severity breakdown

| Severity | CVEs |
| --- | --- |
| Critical | 0 |
| High | 1 |
| Medium | 5 |
| Low | 0 |
| Unscored | 0 |

## Most common weakness types

| CWE | Name | CVEs |
| --- | --- | --- |
| [CWE-862](https://radicalnotion.ai/cwe/cwe-862) | Missing Authorization | 1 |

## CVEs by year

| Year | CVEs published |
| --- | --- |
| 2023 | 4 |
| 2024 | 1 |
| 2025 | 0 |
| 2026 | 1 |

## Affected versions

| Version | Kind | CVEs |
| --- | --- | --- |
| \< 1.0.0 | range | 4 |
| \< 8.0.2 | range | 1 |
| \<= 1.0.5 | range | 1 |
| 1.0.0 | patched | 4 |
| 8.0.2 | patched | 1 |

## CVEs

| CVE | Title | Severity | CVSS | CISA KEV | Public exploit | Patch |
| --- | --- | --- | --- | --- | --- | --- |
| CVE-2026-4338 | ActivityPub Routing \< 8.0.2 - Unauthenticated Drafts/Scheduled/Pending Posts Disclosure | high | 7.5 | No | Yes | Yes |
| CVE-2023-52199 | WordPress ActivityPub plugin \<= 1.0.5 - Unauthenticated Broken Access Control vulnerability | medium | 6.5 | No | No | Yes |
| CVE-2023-3706 | ActivityPub for WordPress \< 1.0.0 - Subscriber+ Arbitrary Post Title Disclosure | medium | 4.3 | No | Yes | Yes |
| CVE-2023-3746 | ActivityPub for WordPress \< 1.0.1 - Contributor+ Stored XSS | medium | 5.4 | No | Yes | Yes |
| CVE-2023-5057 | ActivityPub for WordPress \< 1.0.0 - Contributor+ Stored XSS | medium | 5.4 | No | Yes | Yes |
| CVE-2023-3707 | ActivityPub for WordPress \< 1.0.0 - Subscriber+ Arbitrary Post Content Disclosure | medium | 4.3 | No | Yes | Yes |

## Frequently asked questions

### How many CVEs does Automattic activitypub have?

Automattic activitypub has 6 published CVE records since 2023.

### How many Automattic activitypub CVEs are in CISA KEV?

None of Automattic activitypub's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

### Are there public exploits for Automattic activitypub vulnerabilities?

Yes — 5 of Automattic activitypub's CVEs have a known public exploit.

### Which versions of Automattic activitypub are affected?

5 distinct Automattic activitypub versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

### What are the most common weakness types in Automattic activitypub CVEs?

Automattic activitypub's CVEs most often map to these CWE weakness types: CWE-862 (Missing Authorization).

### What is the average severity of Automattic activitypub CVEs?

The average CVSS base score across Automattic activitypub's scored CVEs is 5.6.

## Other products from this vendor

- [Jetpack](https://radicalnotion.ai/vendor/automattic/jetpack) (20 CVEs)
- [WooCommerce](https://radicalnotion.ai/vendor/automattic/woocommerce) (19 CVEs)
- [Sensei LMS](https://radicalnotion.ai/vendor/automattic/sensei-lms) (10 CVEs)
- [mongoose](https://radicalnotion.ai/vendor/automattic/mongoose) (8 CVEs)
- [sensei](https://radicalnotion.ai/vendor/automattic/sensei) (6 CVEs)
- [WordPress](https://radicalnotion.ai/vendor/automattic/wordpress) (6 CVEs)
- [WP Super Cache](https://radicalnotion.ai/vendor/automattic/wp-super-cache) (6 CVEs)
- [Jetpack CRM](https://radicalnotion.ai/vendor/automattic/jetpack-crm) (5 CVEs)

---

Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/automattic/activitypub). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.