Read the docs

Automattic

Records125All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical9CVSS 9.0–10.0
CVSS high38CVSS 7.0–8.9

Exploited now

Automattic records in CISA KEV

No Automattic vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Jetpack 16 records HIGH Sensei Lms 6 records HIGH Wp Super Cache 6 records HIGH Activitypub 5 records HIGH Woopayments 5 records HIGH Crowdsignal Dashboard 4 records LOW Jetpack Crm 4 records MEDIUM Mailpoet 3 records MEDIUM

Records

5 records in Activitypub · all components

TI-2023-03499 CVE-2023-3746 · GHSA-32jc-368c-fvg6

ActivityPub for WordPress < 1.0.1 - Contributor+ Stored XSS

Priority MEDIUM 58

The ActivityPub WordPress plugin before 1.0.0 does not sanitize and escape some data from post content, which could allow contributor and above role to perform Stored Cross-Site Scripting attacks

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.005 Published 2023-10-16 Fixed in 1.0.0
TI-2023-03463 CVE-2023-3707 · GHSA-2cc2-mcjj-r4mp

ActivityPub for WordPress < 1.0.0 - Subscriber+ Arbitrary Post Content Disclosure

Priority MEDIUM 53

The ActivityPub WordPress plugin before 1.0.0 does not ensure that post contents to be displayed are public and belong to the plugin, allowing any authenticated user, such as subscriber to retrieve the content of arbitra…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0057 Published 2023-10-16 Fixed in 1.0.0
TI-2023-03462 CVE-2023-3706 · GHSA-mc66-gqxj-pwmg

ActivityPub for WordPress < 1.0.0 - Subscriber+ Arbitrary Post Title Disclosure

Priority MEDIUM 53

The ActivityPub WordPress plugin before 1.0.0 does not ensure that post titles to be displayed are public and belong to the plugin, allowing any authenticated user, such as subscriber to retrieve the title of arbitrary p…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0057 Published 2023-10-16 Fixed in 1.0.0
TI-2023-04657 CVE-2023-5057 · GHSA-rcgg-pr6j-3pmh

ActivityPub for WordPress < 1.0.0 - Contributor+ Stored XSS

Priority LOW 25

The ActivityPub WordPress plugin before 1.0.0 does not escape user metadata before outputting them in mentions, which could allow users with a role of Contributor and above to perform Stored XSS attacks

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0049 Published 2023-10-16 Fixed in 1.0.0
Open these records in search →