A
Vendor security profile
automattic
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs9
Critical0
CISA KEV0
Public exploit1
Patch rate%11
Avg. CVSS6.3
12-month vulnerability rate
0
0
0
0
0
1
0
0
0
1
1
5
CVE KEV
CVE severity distribution
9toplam CVE
High3 (33%)
Medium6 (67%)
Patch and exploitation view
%11
Verified patch
%0
CISA KEV
%11
Public exploit
1Patch available
0Partial
0Workaround
0Vendor: no patch
8Unknown
Latest vulnerabilities
6.5
CVE-2026-40808
WordPress Jetpack VideoPress plugin <= 3.6 - Broken Access Control vulnerability
A
Patch status unknownEPSS %0
7.2
CVE-2026-106608
WordPress WooCommerce plugin 9.8.0-11.1.2 - Shop Manager+ Privilege Escalation vulnerability
A
Patch status unknownEPSS %0
5.4
CVE-2026-106601
WordPress Jetpack plugin <= 16.2 - Broken Authentication vulnerability
A
Patch status unknownEPSS %0
4.8
CVE-2026-106602
WordPress Jetpack plugin <= 16.2 - Broken Authentication vulnerability
A
Patch status unknownEPSS %0
6.9
CVE-2026-66666
WordPress Core <= 7.1.2 - Unauthenticated Sensitive Data Exposure of Comments on Private and Unpublished Posts via Comment Feed vulnerability
A
Patch status unknownEPSS %0
7.1
CVE-2026-93485
WordPress core <= 7.1 - Unauth. Cross Site Scripting (XSS) vulnerability
A
Patch status unknownEPSS %0
6.5
CVE-2026-73562
Mongoose: Prototype pollution in the update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)
A
Patch verifiedEPSS %1
7.5
CVE-2026-4338
Vulnerability in Automattic Activitypub
A
Patch status unknownEPSS %0
4.9
CVE-2024-1310
Vulnerability in Automattic Woocommerce
A
Patch status unknownEPSS %1