[ Vendor · 7 CVEs ]
Automattic
CVEs affecting Automattic published in the last 30 days, plus any Automattic CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-112328 | 19 Oct 2026 | CVSS 4.3 | Automattic Sensei LMSThe Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the add_new_module_term AJAX handler that allows… | |
| CVE-2026-112329 | 19 Oct 2026 | CVSS 4.3 | Automattic Sensei LMSThe Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the legacy save_new_message handler hooked on the… | |
| CVE-2026-40808 | 10 Oct 2026 | CVSS 6.5 | Automattic Jetpack VideoPressSubscriber Broken Access Control in Jetpack VideoPress <= 3.6 versions. | |
| CVE-2026-106608 | 10 Oct 2026 | CVSS 7.2 | Automattic WooCommerceIncorrect Privilege Assignment vulnerability in Automattic WooCommerce woocommerce allows Privilege Escalation.This issue affects WooCommerce: from… | |
| CVE-2026-106601 | 9 Oct 2026 | CVSS 5.4 | Automattic JetpackAuthentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack allows Password Recovery Exploitation.This issue… | |
| CVE-2026-106602 | 9 Oct 2026 | CVSS 4.8 | Automattic JetpackAuthentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack allows Password Recovery Exploitation.This issue… | |
| CVE-2026-66666 | 6 Oct 2026 | CVSS 6.9 | Automattic WordPressInsertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data. This issue affects… |