A
Vendor security profile
automattic
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs10
Critical1
CISA KEV0
Public exploit2
Patch rate%10
Avg. CVSS6.7
12-month vulnerability rate
0
0
0
0
0
1
0
0
0
1
1
5
CVE KEV
CVE severity distribution
10toplam CVE
Critical1 (10%)
High3 (30%)
Medium6 (60%)
Patch and exploitation view
%10
Verified patch
%0
CISA KEV
%20
Public exploit
1Patch available
0Partial
0Workaround
0Vendor: no patch
9Unknown
Latest vulnerabilities
6.5
CVE-2026-40808
WordPress Jetpack VideoPress plugin <= 3.6 - Broken Access Control vulnerability
A
Patch status unknownEPSS %0
7.2
CVE-2026-106608
WordPress WooCommerce plugin 9.8.0-11.1.2 - Shop Manager+ Privilege Escalation vulnerability
A
Patch status unknownEPSS %0
5.4
CVE-2026-106601
WordPress Jetpack plugin <= 16.2 - Broken Authentication vulnerability
A
Patch status unknownEPSS %0
4.8
CVE-2026-106602
WordPress Jetpack plugin <= 16.2 - Broken Authentication vulnerability
A
Patch status unknownEPSS %0
6.9
CVE-2026-66666
WordPress Core <= 7.1.2 - Unauthenticated Sensitive Data Exposure of Comments on Private and Unpublished Posts via Comment Feed vulnerability
A
Patch status unknownEPSS %0
7.1
CVE-2026-93485
WordPress core <= 7.1 - Unauth. Cross Site Scripting (XSS) vulnerability
A
Patch status unknownEPSS %0
6.5
CVE-2026-73562
Mongoose: Prototype pollution in the update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)
A
Patch verifiedEPSS %1
7.5
CVE-2026-4338
Vulnerability in Automattic Activitypub
A
Patch status unknownEPSS %0
4.9
CVE-2024-1310
Vulnerability in Automattic Woocommerce
A
Patch status unknownEPSS %1
9.8
CVE-2023-28121
Improper authentication in Automattic Woocommerce Payments
A
Patch status unknownEPSS %87