CVE-2025-69015

WordPress Crowdsignal Forms plugin <= 1.7.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Automattic Crowdsignal Forms crowdsignal-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Crowdsignal Forms: from n/a through <= 1.7.2.

CVSS 3.1 · 3.8 Low EPSS < 1% KEV · Not listed

Vendors

Automattic Wordpress

Products

Crowdsignal Forms Wordpress

CVE-2025-49042

WordPress WooCommerce plugin <= 10.0.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooCommerce woocommerce allows Stored XSS.This issue affects WooCommerce: from n/a through <= 10.0.2.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Automattic Wordpress

Products

Woocommerce Wordpress

CVE-2025-26762

WordPress WooCommerce plugin <= 9.7.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooCommerce woocommerce allows Stored XSS.This issue affects WooCommerce: from n/a through <= 9.7.0.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Automattic Wordpress

Products

Woocommerce Wordpress

CVE-2025-22740

WordPress Sensei LMS plugin <= 4.24.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in Automattic Sensei LMS sensei-lms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sensei LMS: from n/a through <= 4.24.4.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Automattic Wordpress

Products

Sensei Lms Wordpress

CVE-2026-3589

WooCommerce < 10.5.3 - Arbitrary Admin User Creation via CSRF

The WooCommerce WordPress plugin from versions 5.4.0 to 10.5.2 does not properly handle batch requests, which could allow unauthenticated users to make a logged in admin call non store/WC REST endpoints, and create arbitrary admin users via a CSRF attack for example.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Automattic Wordpress

Products

Woocommerce Wordpress

CVE-2026-4338

ActivityPub Routing < 8.0.2 - Unauthenticated Drafts/Scheduled/Pending Posts Disclosure

The ActivityPub WordPress plugin before 8.0.2 does not properly filter posts to be displayed, allowed unauthenticated users to access drafts/scheduled/pending posts

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Activitypub Automattic Wordpress

Products

Activitypub Activitypub Wordpress

CVE-2026-25404

WordPress WP Job Manager plugin <= 2.4.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Automattic WP Job Manager wp-job-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Manager: from n/a through <= 2.4.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Automattic Wordpress

Products

Wp Job Manager Wordpress

CVE-2023-7320

WooCommerce <= 7.8.2 - Sensitive Information Exposure

The WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 7.8.2, due to improper CORS handling on the Store API's REST endpoints allowing direct external access from any origin. This can allow unauthenticated attackers to extract sensitive user information including PII(Personal Identifiable Information).

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Automattic Wordpress

Products

Woocommerce Wordpress

CVE-2025-15033

WooCommerce - Subscriber/Customer+ Order Data Disclosure

A vulnerability in WooCommerce 8.1 to 10.4.2 can allow logged-in customers to access order data of guest customers on sites with a certain configuration. This has been fixed in WooCommerce 10.4.3, as well as all the previously affected versions through point releases, starting from 8.1, where it has been fixed in 8.1.3. It does not affect WooCommerce 8.0 or earlier.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Automattic

Products

Woocommerce

CVE-2025-13457

WooCommerce Square <= 5.1.1 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure in get_token_by_id

The WooCommerce Square plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.1 via the get_token_by_id function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to expose arbitrary Square "ccof" (credit card on file) values and leverage this value to potentially make fraudulent charges on the target site.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Automattic Woocommerce Wordpress

Products

Woocommerce Square Woocommerce Wordpress

CVE-2024-39666

WordPress WooCommerce plugin <= 9.1.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Automattic WooCommerce.This issue affects WooCommerce: from n/a through 9.1.2.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Automattic Wordpress

Products

Woocommerce Wordpress

CVE-2024-37475

WordPress Newspack Newsletters plugin <= 2.13.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Automattic Newspack Newsletters allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Newspack Newsletters: from n/a through 2.13.2.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Automattic

Products

Newspack Newsletters

CVE-2024-35777

WordPress WooCommerce plugin <= 8.9.2 - Content Injection vulnerability

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Automattic WooCommerce allows Content Spoofing.This issue affects WooCommerce: from n/a through 8.9.2.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Automattic Wordpress

Products

Woocommerce Wordpress

CVE-2024-35686

WordPress Sensei LMS plugin <= 4.23.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Automattic Sensei LMS, Automattic Sensei Pro (WC Paid Courses).This issue affects Sensei LMS: from n/a through 4.23.1; Sensei Pro (WC Paid Courses): from n/a through 4.23.1.1.23.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Automattic

Products

Sensei Lms Sensei Pro

CVE-2023-52212

WordPress WP Job Manager plugin <= 2.0.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Automattic WP Job Manager allows Cross Site Request Forgery.This issue affects WP Job Manager: from n/a through 2.0.0.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Automattic Wordpress

Products

Wp Job Manager Wordpress

CVE-2024-10486

Google for WooCommerce <= 2.8.6 - Information Disclosure via Publicly Accessible PHP Info File

The Google for WooCommerce plugin for WordPress is vulnerable to Information Disclosure in all versions up to, and including, 2.8.6. This is due to publicly accessible print_php_information.php file. This makes it possible for unauthenticated attackers to retrieve information about Webserver and PHP configuration, which can be used to aid other attacks.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Automattic

Products

Woocommerce

CVE-2022-3342

Jetpack CRM <= 5.3.1 - Cross-Site Request Forgery and PHAR Deserialization

The Jetpack CRM plugin for WordPress is vulnerable to PHAR deserialization via the ‘zbscrmcsvimpf’ parameter in the 'zeroBSCRM_CSVImporterLitehtml_app' function in versions up to, and including, 5.3.1. While the function performs a nonce check, steps 2 and 3 of the check do not take any action upon a failed check. These steps then perform a 'file_exists' check on the value of 'zbscrmcsvimpf'. If a phar:// archive is supplied, its contents will be deserialized and an object injected in the execution stream. This allows an unauthenticated attacker to obtain object injection if they are able to upload a phar archive (for instance if the site supports image uploads) and then trick an administrator into performing an action, such as clicking a link.

CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed

Vendors

Automattic

Products

Jetpack Crm

CVE-2024-4392

Jetpack – WP Security, Backup, Speed, & Growth <= 13.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpvideo Shortcode

The Jetpack – WP Security, Backup, Speed, & Growth plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpvideo shortcode in all versions up to, and including, 13.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Automattic Wordpress

Products

Jetpack Wordpress

CVE-2023-54332

Jetpack 11.4 - Cross Site Scripting (XSS)

Jetpack 11.4 contains a cross-site scripting vulnerability in the contact form module that allows attackers to inject malicious scripts through the post_id parameter. Attackers can craft malicious URLs with script payloads to execute arbitrary JavaScript in victims' browsers when they interact with the contact form page.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Automattic

Products

Jetpack Jetpack Boost

CVE-2023-47788

WordPress Jetpack plugin < 12.7 - Contributor+ Broken Access Control vulnerability

Missing Authorization vulnerability in Automattic Jetpack.This issue affects Jetpack: from n/a before 12.7.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Automattic Wordpress

Products

Jetpack Wordpress