Read the docs

Automattic

Records125All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical9CVSS 9.0–10.0
CVSS high38CVSS 7.0–8.9

Exploited now

Automattic records in CISA KEV

No Automattic vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Jetpack 16 records HIGH Sensei Lms 6 records HIGH Wp Super Cache 6 records HIGH Activitypub 5 records HIGH Woopayments 5 records HIGH Crowdsignal Dashboard 4 records LOW Jetpack Crm 4 records MEDIUM Mailpoet 3 records MEDIUM

Records

4 records in Jetpack Crm · all components

TI-2022-04111 CVE-2022-4497 · GHSA-fpfr-g8vf-4jhr

Jetpack CRM < 5.5 - Contributor+ Stored XSS

Priority MEDIUM 58

The Jetpack CRM WordPress plugin before 5.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stor…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00573 Published 2023-01-09 Fixed in 5.5
TI-2022-03594 CVE-2022-3919 · GHSA-h78h-f6r8-7qx8

Jetpack CRM < 5.4.3 - Admin+ Cross-Site Scripting

Priority MEDIUM 55

The Jetpack CRM WordPress plugin before 5.4.3 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is dis…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.0053 Published 2022-12-12 Fixed in 5.4.3
TI-2022-03089 CVE-2022-3342 · GHSA-w42r-qhq4-9fc9

Jetpack CRM <= 5.3.1 - Cross-Site Request Forgery and PHAR Deserialization

Priority MEDIUM 43

The Jetpack CRM plugin for WordPress is vulnerable to PHAR deserialization via the ‘zbscrmcsvimpf’ parameter in the 'zeroBSCRM_CSVImporterLitehtml_app' function in versions up to, and including, 5.3.1.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01269 Published 2023-10-20 No fix listed CWE-502
Open these records in search →