Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,080 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Not this one?Jetpackwoocommerce-jetpackJetpack CRMreCAPTCHA JetpackJetpack Debug Toolsjetpack-videopressTiled Gallery Carousel Without JetPackJetpack Feedback Exporter
Plugin · jetpack
Jetpack
15 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 9, 2026Jetpack: Authentication Bypass Using an Alternate Path or ChannelCVE-2026-106602 · affects up to 16.2 · reported by PatchstackMedium 4.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack allows Password Recovery Exploitation.This issue affects Jetpack: from n/a through 16.2.
Oct 9, 2026Jetpack: Authentication Bypass Using an Alternate Path or ChannelCVE-2026-106601 · affects up to 16.2 · reported by PatchstackMedium 5.4
Authentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack allows Password Recovery Exploitation.This issue affects Jetpack: from n/a through 16.2.
May 10, 2026WordPress Plugin Jetpack 9.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipuCVE-2022-50958 · reported by VulnCheckMedium 5.1
WordPress Plugin Jetpack 9.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating the post_id parameter. Attackers can craft URLs to the grunion-form-view.php endpoint with script payloads in the post_id parameter to execute arbitrary JavaScript in victim browsers.
Jan 13, 2026the contact form module that: Jetpack 11.4 contains a cross-site scriptingCVE-2023-54332 · affects 11.4 to 11.4 · reported by VulnCheckMedium 5.1
Jetpack 11.4 contains a cross-site scripting vulnerability in the contact form module that allows attackers to inject malicious scripts through the post_id parameter. Attackers can craft malicious URLs with script payloads to execute arbitrary JavaScript in victims' browsers when they interact with the contact form page.
May 15, 2025Jetpack: Does not ensure that the post created by the Contact Form is only accessible to authorised usersCVE-2024-10075 · fixed in 13.8 · reported by WPScanMedium 5.6
The Jetpack WordPress plugin before 13.8 does not ensure that the post created by the Contact Form is only accessible to authorised users, which could allow unauthenticated users to run arbitrary shortcodes and block.
Dec 25, 2024Jetpack: Does not properly checks the postmessage origin in its 13CVE-2024-10858 · fixed in 14.1 · reported by WPScanMedium 6.1
The Jetpack WordPress plugin before 14.1 does not properly checks the postmessage origin in its 13.x versions, allowing it to be bypassed and leading to DOM-XSS. The issue only affects websites hosted on WordPress.com.
Jun 19, 2024Jetpack: Missing AuthorizationCVE-2023-47788 · fixed in 12.7 · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Automattic Jetpack.This issue affects Jetpack: from n/a before 12.7.
May 14, 2024Jetpack – WP Security, Backup, Speed, & Growth: Stored Cross-Site ScriptingCVE-2024-4392 · affects up to 13.3.1 · reported by WordfenceMedium 6.4
The Jetpack – WP Security, Backup, Speed, & Growth plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpvideo shortcode in all versions up to, and including, 13.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Apr 24, 2024Jetpack: Improper Restriction of Rendered UI Layers or FramesCVE-2023-47774 · fixed in 12.7 · reported by PatchstackMedium 5.4
Improper Restriction of Rendered UI Layers or Frames vulnerability in Automattic Jetpack allows Clickjacking.This issue affects Jetpack: from n/a before 12.7.
Nov 30, 2023Jetpack – WP Security, Backup, Speed, & Growth: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-45050 · affects up to 12.8-a.1 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic Jetpack – WP Security, Backup, Speed, & Growth allows Stored XSS.This issue affects Jetpack – WP Security, Backup, Speed, & Growth: from n/a through 12.8-a.1.
Jun 27, 2023Jetpack: Does not validate uploaded filesCVE-2023-2996 · fixed in 12.1.1 · reported by WPScanHigh 8.8
The Jetpack WordPress plugin before 12.1.1 does not validate uploaded files, allowing users with author roles or above to manipulate existing files on the site, deleting arbitrary files, and in rare cases achieve Remote Code Execution via phar deserialization.
Aug 28, 2019The Jetpack plugin before 3.4.3 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9359 · fixed in 3.4.3 · reported by MITREMedium 6.1
The Jetpack plugin before 3.4.3 for WordPress has XSS via add_query_arg() and remove_query_arg().
Jan 12, 2018The Jetpack plugin before 4.0.3 for WordPress has XSS via a crafted Vimeo link.CVE-2016-10706 · fixed in 4.0.3 · reported by MITREMedium 6.1
The Jetpack plugin before 4.0.3 for WordPress has XSS via a crafted Vimeo link.
Jan 12, 2018The Jetpack plugin before 4.0.4 for WordPress has XSS via the Likes module.CVE-2016-10705 · fixed in 4.0.4 · reported by MITREMedium 6.1
The Jetpack plugin before 4.0.4 for WordPress has XSS via the Likes module.
Apr 22, 2014The Jetpack plugin before 1.9 before 1.9.4, 2.0.x before 2.0.9, 2.1.x before 2.1.4, 2.2.x before 2.2.7, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5CVE-2014-0173 · fixed in 1.9 · reported by Red HatMedium 5.8
The Jetpack plugin before 1.9 before 1.9.4, 2.0.x before 2.0.9, 2.1.x before 2.1.4, 2.2.x before 2.2.7, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.2, 2.6.x before 2.6.3, 2.7.x before 2.7.2, 2.8.x before 2.8.2, and 2.9.x before 2.9.3 for WordPress does not properly restrict access to the XML-RPC service, which allows remote attackers to bypass intended restrictions and publish posts via unspecified vectors. NOTE: some of these details are obtained from third party information.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.