Automattic maintains a focused but deeply embedded portfolio of WordPress-centric plugins and services—including Jetpack, Sensei LMS, WP Super Cache, ActivityPub, and WooPayments—that collectively span content management, e-commerce, learning platforms, and social integration across millions of websites. The vendor's vulnerability footprint reflects its plugin and SaaS architecture: a moderate volume of disclosures that skew toward web-application weaknesses such as cross-site scripting, authorization bypass, CSRF, and code injection, all endemic to the WordPress ecosystem's extension model and user-generated content handling. Vulnerabilities affecting this vendor frequently acquire public exploit code, underscoring the value and accessibility of WordPress-targeting tools to attackers. Defenders should prioritize patching these plugins on exposed WordPress instances, as their ubiquity and web-facing nature make them a persistent target surface; current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Automattic over time
Signals from CVEs in this vendor scope (88 CVEs).
88 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2023-28121CRITICAL An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an unauthenticated attacker to send requests on behalf of an elevated user, like administrat | Apr 12, 2023 | 9.8 | 89 | NO | YES |
CVE-2013-2010CRITICAL WordPress W3 Total Cache Plugin 0.9.2.8 has a Remote PHP Code Execution Vulnerability | Feb 12, 2020 | 9.8 | 88 | NO | YES |
CVE-2017-17058HIGH The WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/woocommerce/templates/emails/plain/ URI, which accesses a parent | Nov 29, 2017 | 7.5 | 48 | NO | YES |
CVE-2021-32789HIGH woocommerce-gutenberg-products-block is a feature plugin for WooCommerce Gutenberg Blocks. An SQL injection vulnerability impacts all WooCommerce sites running the WooCommerce Bloc | Jul 26, 2021 | 7.5 | 42 | NO | YES |
CVE-2013-2009HIGH WordPress WP Super Cache Plugin 1.2 has Remote PHP Code Execution | Feb 7, 2020 | 8.8 | 37 | NO | YES |
CVE-2013-2011HIGH WordPress W3 Super Cache Plugin before 1.3.2 contains a PHP code-execution vulnerability which could allow remote attackers to inject arbitrary code. This issue exists because of a | Dec 26, 2019 | 8.8 | 34 | NO | NO |
CVE-2011-4673HIGH SQL injection vulnerability in modules/sharedaddy.php in the Jetpack plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter. | Dec 2, 2011 | 7.5 | 33 | NO | YES |
CVE-2021-24209HIGH The WP Super Cache WordPress plugin before 1.7.2 was affected by an authenticated (admin+) RCE in the settings page due to input validation failure and weak $cache_path check in th | Apr 5, 2021 | 7.2 | 32 | NO | NO |
CVE-2022-2034MEDIUM The Sensei LMS WordPress plugin before 4.5.0 does not have proper permissions set in one of its REST endpoint, allowing unauthenticated users to access private messages sent to tea | Aug 29, 2022 | 5.3 | 30 | NO | YES |
CVE-2023-35915CRITICAL Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo. | Dec 20, 2023 | 9.8 | 29 | NO | NO |
Signals from CVEs in this vendor scope (88 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Automattic.
Media articles that mention a CVE ID that affects a product developed by Automattic — matched by CVE ID, not by vendor name.