EN ES
Start free
Menu

Jetpack – AI Agents & MCP, Security, Backup & Analytics: known security problems

33 known security problems reported for this WordPress plugin, with the affected versions, the fix and what to do.

Updated

In short

There are 33 known security problems on this page. Each one has a fixed version. Updating to version 16.3 or newer covers every fixed problem listed here.

Based on public reports. Check the plugin’s changelog. Watchfox AI may be wrong.

Get an email when your site is affected: install Watchfox AI (free)

This week

Someone could do things on your site they should not be allowed to (up to and including 16.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 16.2
Fixed in
16.3
What to do
If your site has an affected version, update Jetpack – AI Agents & MCP, Security, Backup & Analytics to version 16.3 or newer.
Official ID
CVE-2026-106601
Report title
Jetpack – WP Security, Backup, Speed, & Growth <= 16.2 - Missing Authorization
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 16.2) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 16.2
Fixed in
16.3
What to do
If your site has an affected version, update Jetpack – AI Agents & MCP, Security, Backup & Analytics to version 16.3 or newer.
Official ID
CVE-2026-106602
Report title
Jetpack – WP Security, Backup, Speed, & Growth <= 16.2 - Missing Authorization
First reported
Sources
This week

A stranger could plant harmful code that runs for your visitors or admins

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • From 16.1 up to and including 16.1.2
Fixed in
16.1.3
What to do
If your site has an affected version, update Jetpack – AI Agents & MCP, Security, Backup & Analytics to version 16.1.3 or newer.
Report title
Jetpack – WP Security, Backup, Speed, & Growth 16.1 - 16.1.2 - Unauthenticated Stored Cross-Site Scripting
First reported
Sources
This week

Someone who already has an admin account could in some setups, take over your site (from 16.1 up to and including 16.1.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • From 16.1 up to and including 16.1.2
Fixed in
16.1.3
What to do
If your site has an affected version, update Jetpack – AI Agents & MCP, Security, Backup & Analytics to version 16.1.3 or newer.
Report title
Jetpack – WP Security, Backup, Speed, & Growth 16.1 - 16.1.2 - Authenticated (Administrator+) PHP Object Injection
First reported
Sources
This week

Someone who already has an admin account could in some setups, take over your site (from 16.1 up to and including 16.1.2) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • From 16.1 up to and including 16.1.2
Fixed in
16.1.3
What to do
If your site has an affected version, update Jetpack – AI Agents & MCP, Security, Backup & Analytics to version 16.1.3 or newer.
Report title
Jetpack – WP Security, Backup, Speed, & Growth 16.1 - 16.1.2 - Authenticated (Administrator+) PHP Object Injection
First reported
Sources
This week

Someone who already has an admin account could in some setups, take over your site (from 12.0 up to and including 12.0.2; from 12.1 up to and including 12.1.2; from 12.2 up to and including 12.2.2; from 12.3 up to and including 12.3.1; from 12.4 up to and including 12.4.1; from 12.5 up to and including 12.5.1; from 12.6 up to and including 12.6.3; from 12.7 up to and including 12.7.2; from 12.8 up to and including 12.8.2; from 12.9 up to and including 12.9.4; from 13.0 up to and including 13.0.1; from 13.1 up to and including 13.1.4; from 13.2 up to and including 13.2.3; from 13.3 up to and including 13.3.2; from 13.4 up to and including 13.4.4; from 13.5 up to and including 13.5.1; from 13.6 up to and including 13.6.1; from 13.7 up to and including 13.7.1; from 13.8 up to and including 13.8.2; from 13.9 up to and including 13.9.1; from 14.0 up to and including 14.0; from 14.1 up to and including 14.1; from 14.2 up to and including 14.2.1; from 14.3 up to and including 14.3; from 14.4 up to and including 14.4.1; from 14.5 up to and including 14.5; from 14.6 up to and including 14.6; from 14.7 up to and including 14.7; from 14.8 up to and including 14.8; from 14.9 up to and including 14.9.1; from 15.0 up to and including 15.0.2; from 15.1 up to and including 15.1.1; from 15.2 up to and including 15.2; from 15.3 up to and including 15.3.1; from 15.4 up to and including 15.4; from 15.5 up to and including 15.5; from 15.6 up to and including 15.6; from 15.7 up to and including 15.7.1; from 15.8 up to and including 15.8; from 15.9 up to and including 15.9.1; from 16.0 up to and including 16.0.1; from 16.1 up to and including 16.1.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • From 12.0 up to and including 12.0.2
  • From 12.1 up to and including 12.1.2
  • From 12.2 up to and including 12.2.2
  • From 12.3 up to and including 12.3.1
  • From 12.4 up to and including 12.4.1
  • From 12.5 up to and including 12.5.1
  • From 12.6 up to and including 12.6.3
  • From 12.7 up to and including 12.7.2
  • From 12.8 up to and including 12.8.2
  • From 12.9 up to and including 12.9.4
  • From 13.0 up to and including 13.0.1
  • From 13.1 up to and including 13.1.4
  • From 13.2 up to and including 13.2.3
  • From 13.3 up to and including 13.3.2
  • From 13.4 up to and including 13.4.4
  • From 13.5 up to and including 13.5.1
  • From 13.6 up to and including 13.6.1
  • From 13.7 up to and including 13.7.1
  • From 13.8 up to and including 13.8.2
  • From 13.9 up to and including 13.9.1
  • From 14.0 up to and including 14.0
  • From 14.1 up to and including 14.1
  • From 14.2 up to and including 14.2.1
  • From 14.3 up to and including 14.3
  • From 14.4 up to and including 14.4.1
  • From 14.5 up to and including 14.5
  • From 14.6 up to and including 14.6
  • From 14.7 up to and including 14.7
  • From 14.8 up to and including 14.8
  • From 14.9 up to and including 14.9.1
  • From 15.0 up to and including 15.0.2
  • From 15.1 up to and including 15.1.1
  • From 15.2 up to and including 15.2
  • From 15.3 up to and including 15.3.1
  • From 15.4 up to and including 15.4
  • From 15.5 up to and including 15.5
  • From 15.6 up to and including 15.6
  • From 15.7 up to and including 15.7.1
  • From 15.8 up to and including 15.8
  • From 15.9 up to and including 15.9.1
  • From 16.0 up to and including 16.0.1
  • From 16.1 up to and including 16.1.2
Fixed in
12.0.3, 12.1.3, 12.2.3, 12.3.2, 12.4.2, 12.5.2, 12.6.4, 12.7.3, 12.8.3, 12.9.5, 13.0.2, 13.1.5, 13.2.4, 13.3.3, 13.4.5, 13.5.2, 13.6.2, 13.7.2, 13.8.3, 13.9.2, 14.0.1, 14.1.1, 14.2.2, 14.3.1, 14.4.2, 14.5.1, 14.6.1, 14.7.1, 14.8.1, 14.9.2, 15.0.3, 15.1.2, 15.2.1, 15.3.2, 15.4.1, 15.5.1, 15.6.1, 15.7.2, 15.8.1, 15.9.2, 16.0.2, 16.1.3
What to do
If your site has an affected version, update Jetpack – AI Agents & MCP, Security, Backup & Analytics to version 16.1.3 or newer.
Report title
Jetpack 12.0 - 16.1.2 - Authenticated (Administrator+) PHP Object Injection
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (from 14.5 up to and including 14.5; from 14.6 up to and including 14.6; from 14.7 up to and including 14.7; from 14.8 up to and including 14.8; from 14.9 up to and including 14.9.1; from 15.0 up to and including 15.0.2; from 15.1 up to and including 15.1.1; from 15.2 up to and including 15.2; from 15.3 up to and including 15.3.1; from 15.4 up to and including 15.4; from 15.5 up to and including 15.5; from 15.6 up to and including 15.6; from 15.7 up to and including 15.7.1; from 15.8 up to and including 15.8; from 15.9 up to and including 15.9.1; from 16.0 up to and including 16.0.1; from 16.1 up to and including 16.1.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • From 14.5 up to and including 14.5
  • From 14.6 up to and including 14.6
  • From 14.7 up to and including 14.7
  • From 14.8 up to and including 14.8
  • From 14.9 up to and including 14.9.1
  • From 15.0 up to and including 15.0.2
  • From 15.1 up to and including 15.1.1
  • From 15.2 up to and including 15.2
  • From 15.3 up to and including 15.3.1
  • From 15.4 up to and including 15.4
  • From 15.5 up to and including 15.5
  • From 15.6 up to and including 15.6
  • From 15.7 up to and including 15.7.1
  • From 15.8 up to and including 15.8
  • From 15.9 up to and including 15.9.1
  • From 16.0 up to and including 16.0.1
  • From 16.1 up to and including 16.1.2
Fixed in
14.5.1, 14.6.1, 14.7.1, 14.8.1, 14.9.2, 15.0.3, 15.1.2, 15.2.1, 15.3.2, 15.4.1, 15.5.1, 15.6.1, 15.7.2, 15.8.1, 15.9.2, 16.0.2, 16.1.3
What to do
If your site has an affected version, update Jetpack – AI Agents & MCP, Security, Backup & Analytics to version 16.1.3 or newer.
Report title
Jetpack 14.5 - 16.1.2 - Reflected to Stored Cross-Site Scripting via Reader Repost Parameters
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (from 3.2 up to and including 16.1.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • From 3.2 up to and including 16.1.2
Fixed in
16.1.3
What to do
If your site has an affected version, update Jetpack – AI Agents & MCP, Security, Backup & Analytics to version 16.1.3 or newer.
Report title
Jetpack 3.2 - 16.1.2 - Missing Authorization on WPCOM Media API Attachment Parent
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (from 13.0 up to and including 14.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • From 13.0 up to and including 14.0
Fixed in
14.1
What to do
If your site has an affected version, update Jetpack – AI Agents & MCP, Security, Backup & Analytics to version 14.1 or newer.
Official ID
CVE-2024-10858
Report title
Jetpack 13.0 - 14.0 - Reflected DOM-based Cross-Site Scripting
First reported
Sources
This week

A stranger could use it to harm your site

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 13.7
Fixed in
13.8
What to do
If your site has an affected version, update Jetpack – AI Agents & MCP, Security, Backup & Analytics to version 13.8 or newer.
Official ID
CVE-2024-10075
Report title
Jetpack <= 13.7 - Unauthenticated Arbitrary Block & Shortcode Execution
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 13.7)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 13.7
Fixed in
13.8
What to do
If your site has an affected version, update Jetpack – AI Agents & MCP, Security, Backup & Analytics to version 13.8 or newer.
Official ID
CVE-2024-10076
Report title
Jetpack <= 13.7 & Jetpack Boost <= 3.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Anyone with an account on your site, even a basic one could do things on your site they should not be allowed to

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • From 10.0 up to and including 10.0.1
  • From 10.1 up to and including 10.1.1
  • From 10.2 up to and including 10.2.2
  • From 10.3 up to and including 10.3.1
  • From 10.4 up to and including 10.4.1
  • From 10.5 up to and including 10.5.2
  • From 10.6 up to and including 10.6.1
  • From 10.7 up to and including 10.7.1
  • From 10.8 up to and including 10.8.1
  • From 10.9 up to and including 10.9.2
  • From 11.0 up to and including 11.0.1
  • From 11.1 up to and including 11.1.3
  • From 11.2 up to and including 11.2.1
  • From 11.3 up to and including 11.3.3
  • From 11.4 up to and including 11.4.1
  • From 11.5 up to and including 11.5.2
  • From 11.6 up to and including 11.6.1
  • From 11.7 up to and including 11.7.2
  • From 11.8 up to and including 11.8.5
  • From 11.9 up to and including 11.9.2
  • From 12.0 up to and including 12.0.1
  • From 12.1 up to and including 12.1.1
  • From 12.2 up to and including 12.2.1
  • From 12.3 up to and including 12.3
  • From 12.4 up to and including 12.4
  • From 12.5 up to and including 12.5
  • From 12.6 up to and including 12.6.2
  • From 12.7 up to and including 12.7.1
  • From 12.8 up to and including 12.8.1
  • From 12.9 up to and including 12.9.3
  • From 13.0 up to and including 13.0
  • From 13.1 up to and including 13.1.3
  • From 13.2 up to and including 13.2.2
  • From 13.3 up to and including 13.3.1
  • From 13.4 up to and including 13.4.3
  • From 13.5 up to and including 13.5
  • From 13.6 up to and including 13.6
  • From 13.7 up to and including 13.7
  • From 13.8 up to and including 13.8.1
  • From 13.9 up to and including 13.9
  • From 3.9 up to and including 3.9.9
  • From 4.0 up to and including 4.0.6
  • From 4.1 up to and including 4.1.3
  • From 4.2 up to and including 4.2.4
  • From 4.3 up to and including 4.3.4
  • From 4.4 up to and including 4.4.4
  • From 4.5 up to and including 4.5.2
  • From 4.6 up to and including 4.6.2
  • From 4.7 up to and including 4.7.3
  • From 4.8 up to and including 4.8.4
  • From 4.9 up to and including 4.9.2
  • From 5.0 up to and including 5.0.2
  • From 5.1 up to and including 5.1.3
  • From 5.2 up to and including 5.2.4
  • From 5.3 up to and including 5.3.3
  • From 5.4 up to and including 5.4.3
  • From 5.5 up to and including 5.5.4
  • From 5.6 up to and including 5.6.4
  • From 5.7 up to and including 5.7.4
  • From 5.8 up to and including 5.8.3
  • From 5.9 up to and including 5.9.3
  • From 6.0 up to and including 6.0.3
  • From 6.1 up to and including 6.1.4
  • From 6.2 up to and including 6.2.4
  • From 6.3 up to and including 6.3.6
  • From 6.4 up to and including 6.4.5
  • From 6.5 up to and including 6.5.3
  • From 6.6 up to and including 6.6.4
  • From 6.7 up to and including 6.7.3
  • From 6.8 up to and including 6.8.4
  • From 6.9 up to and including 6.9.3
  • From 7.0 up to and including 7.0.4
  • From 7.1 up to and including 7.1.4
  • From 7.2 up to and including 7.2.4
  • From 7.3 up to and including 7.3.4
  • From 7.4 up to and including 7.4.4
  • From 7.5 up to and including 7.5.6
  • From 7.6 up to and including 7.6.3
  • From 7.7 up to and including 7.7.5
  • From 7.8 up to and including 7.8.3
  • From 7.9 up to and including 7.9.3
  • From 8.0 up to and including 8.0.2
  • From 8.1 up to and including 8.1.3
  • From 8.2 up to and including 8.2.5
  • From 8.3 up to and including 8.3.2
  • From 8.4 up to and including 8.4.4
  • From 8.5 up to and including 8.5.2
  • From 8.6 up to and including 8.6.3
  • From 8.7 up to and including 8.7.3
  • From 8.8 up to and including 8.8.4
  • From 8.9 up to and including 8.9.3
  • From 9.0 up to and including 9.0.4
  • From 9.1 up to and including 9.1.2
  • From 9.2 up to and including 9.2.3
  • From 9.3 up to and including 9.3.4
  • From 9.4 up to and including 9.4.3
  • From 9.5 up to and including 9.5.4
  • From 9.6 up to and including 9.6.3
  • From 9.7 up to and including 9.7.2
  • From 9.8 up to and including 9.8.2
  • From 9.9 up to and including 9.9.2
Fixed in
3.9.10, 4.0.7, 4.1.4, 4.2.5, 4.3.5, 4.4.5, 4.5.3, 4.6.3, 4.7.4, 4.8.5, 4.9.3, 5.0.3, 5.1.4, 5.2.5, 5.3.4, 5.4.4, 5.5.5, 5.6.5, 5.7.5, 5.8.4, 5.9.4, 6.0.4, 6.1.5, 6.2.5, 6.3.7, 6.4.6, 6.5.4, 6.6.5, 6.7.4, 6.8.5, 6.9.4, 7.0.5, 7.1.5, 7.2.5, 7.3.5, 7.4.5, 7.5.7, 7.6.4, 7.7.6, 7.8.4, 7.9.4, 8.0.3, 8.1.4, 8.2.6, 8.3.3, 8.4.5, 8.5.3, 8.6.4, 8.7.4, 8.8.5, 8.9.4, 9.0.5, 9.1.3, 9.2.4, 9.3.5, 9.4.4, 9.5.5, 9.6.4, 9.7.3, 9.8.3, 9.9.3, 10.0.2, 10.1.2, 10.2.3, 10.3.2, 10.4.2, 10.5.3, 10.6.2, 10.7.2, 10.8.2, 10.9.3, 11.0.2, 11.1.4, 11.2.2, 11.3.4, 11.4.2, 11.5.3, 11.6.2, 11.7.3, 11.8.6, 11.9.3, 12.0.2, 12.1.2, 12.2.2, 12.3.1, 12.4.1, 12.5.1, 12.6.3, 12.7.2, 12.8.2, 12.9.4, 13.0.1, 13.1.4, 13.2.3, 13.3.2, 13.4.4, 13.5.1, 13.6.1, 13.7.1, 13.8.2, 13.9.1
What to do
If your site has an affected version, update Jetpack – AI Agents & MCP, Security, Backup & Analytics to version 13.9.1 or newer.
Official ID
CVE-2024-9926
Report title
Jetpack < 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 13.3.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 13.3.1
Fixed in
13.4
What to do
If your site has an affected version, update Jetpack – AI Agents & MCP, Security, Backup & Analytics to version 13.4 or newer.
Official ID
CVE-2024-4392
Report title
Jetpack – WP Security, Backup, Speed, & Growth <= 13.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpvideo Shortcode
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 12.8-a.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 12.8-a.1
Fixed in
12.8-a.3
What to do
If your site has an affected version, update Jetpack – AI Agents & MCP, Security, Backup & Analytics to version 12.8-a.3 or newer.
Official ID
CVE-2023-45050
Report title
Jetpack <= 12.8-a.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via block attribute
First reported
Sources
This week

Someone with a contributor account on your site could use it to harm your site

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 12.7
Fixed in
12.7
What to do
If your site has an affected version, update Jetpack – AI Agents & MCP, Security, Backup & Analytics to version 12.7 or newer.
Official ID
CVE-2023-47774
Report title
Jetpack < 12.7 - Authenticated(Contributor+) Clickjacking via Iframe Injection
First reported
Sources
This week

Someone could use it to harm your site (before 12.7)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 12.7
Fixed in
12.7
What to do
If your site has an affected version, update Jetpack – AI Agents & MCP, Security, Backup & Analytics to version 12.7 or newer.
Official ID
CVE-2023-47788
Report title
Jetpack <= 12.6.2 - Improper Authorization via WPCom External Media REST endpoints
First reported
Sources
This week

Someone with an author account on your site could use it to harm your site

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • From 10.0 up to and including 10.0
  • From 10.1 up to and including 10.1
  • From 10.2 up to and including 10.2.1
  • From 10.3 up to and including 10.3
  • From 10.4 up to and including 10.4
  • From 10.5 up to and including 10.5.1
  • From 10.6 up to and including 10.6.1
  • From 10.7 up to and including 10.7
  • From 10.8 up to and including 10.8
  • From 10.9 up to and including 10.9.1
  • From 11.0 up to and including 11.0
  • From 11.1 up to and including 11.1.2
  • From 11.2 up to and including 11.2
  • From 11.3 up to and including 11.3.2
  • From 11.4 up to and including 11.4
  • From 11.5 up to and including 11.5.1
  • From 11.6 up to and including 11.6
  • From 11.7 up to and including 11.7.1
  • From 11.8 up to and including 11.8.4
  • From 11.9 up to and including 11.9.1
  • From 12.0 up to and including 12.0
  • From 12.1 up to and including 12.1
  • From 2.0 up to and including 2.0.8
  • From 2.1 up to and including 2.1.6
  • From 2.2 up to and including 2.2.9
  • From 2.3 up to and including 2.3.9
  • From 2.4 up to and including 2.4.6
  • From 2.5 up to and including 2.5.4
  • From 2.6 up to and including 2.6.5
  • From 2.7 up to and including 2.7.4
  • From 2.8 up to and including 2.8.4
  • From 2.9 up to and including 2.9.5
  • From 3.0 up to and including 3.0.5
  • From 3.1 up to and including 3.1.4
  • From 3.2 up to and including 3.2.4
  • From 3.3 up to and including 3.3.5
  • From 3.4 up to and including 3.4.5
  • From 3.5 up to and including 3.5.5
  • From 3.6 up to and including 3.6.3
  • From 3.7 up to and including 3.7.4
  • From 3.8 up to and including 3.8.4
  • From 3.9 up to and including 3.9.8
  • From 4.0 up to and including 4.0.5
  • From 4.1 up to and including 4.1.2
  • From 4.2 up to and including 4.2.3
  • From 4.3 up to and including 4.3.3
  • From 4.4 up to and including 4.4.3
  • From 4.5 up to and including 4.5.1
  • From 4.6 up to and including 4.6.1
  • From 4.7 up to and including 4.7.2
  • From 4.8 up to and including 4.8.3
  • From 4.9 up to and including 4.9.1
  • From 5.0 up to and including 5.0.1
  • From 5.1 up to and including 5.1.2
  • From 5.2 up to and including 5.2.3
  • From 5.3 up to and including 5.3.2
  • From 5.4 up to and including 5.4.2
  • From 5.5 up to and including 5.5.3
  • From 5.6 up to and including 5.6.3
  • From 5.7 up to and including 5.7.3
  • From 5.8 up to and including 5.8.2
  • From 5.9 up to and including 5.9.2
  • From 6.0 up to and including 6.0.2
  • From 6.1 up to and including 6.1.3
  • From 6.2 up to and including 6.2.3
  • From 6.3 up to and including 6.3.5
  • From 6.4 up to and including 6.4.4
  • From 6.5 up to and including 6.5.2
  • From 6.6 up to and including 6.6.3
  • From 6.7 up to and including 6.7.2
  • From 6.8 up to and including 6.8.3
  • From 6.9 up to and including 6.9.2
  • From 7.0 up to and including 7.0.3
  • From 7.1 up to and including 7.1.3
  • From 7.2 up to and including 7.2.3
  • From 7.3 up to and including 7.3.3
  • From 7.4 up to and including 7.4.3
  • From 7.5 up to and including 7.5.5
  • From 7.6 up to and including 7.6.2
  • From 7.7 up to and including 7.7.4
  • From 7.8 up to and including 7.8.2
  • From 7.9 up to and including 7.9.2
  • From 8.0 up to and including 8.0.1
  • From 8.1 up to and including 8.1.2
  • From 8.2 up to and including 8.2.4
  • From 8.3 up to and including 8.3.1
  • From 8.4 up to and including 8.4.3
  • From 8.5 up to and including 8.5.1
  • From 8.6 up to and including 8.6.2
  • From 8.7 up to and including 8.7.2
  • From 8.8 up to and including 8.8.3
  • From 8.9 up to and including 8.9.2
  • From 9.0 up to and including 9.0.3
  • From 9.1 up to and including 9.1.1
  • From 9.2 up to and including 9.2.2
  • From 9.3 up to and including 9.3.3
  • From 9.4 up to and including 9.4.2
  • From 9.5 up to and including 9.5.3
  • From 9.6 up to and including 9.6.2
  • From 9.7 up to and including 9.7.1
  • From 9.8 up to and including 9.8.1
  • From 9.9 up to and including 9.9.1
Fixed in
2.0.9, 2.1.7, 2.2.10, 2.3.10, 2.4.7, 2.5.5, 2.6.6, 2.7.5, 2.8.5, 2.9.6, 3.0.6, 3.1.5, 3.2.5, 3.3.6, 3.4.6, 3.5.6, 3.6.4, 3.7.5, 3.8.5, 3.9.9, 4.0.6, 4.1.3, 4.2.4, 4.3.4, 4.4.4, 4.5.2, 4.6.2, 4.7.3, 4.8.4, 4.9.2, 5.0.2, 5.1.3, 5.2.4, 5.3.3, 5.4.3, 5.5.4, 5.6.4, 5.7.4, 5.8.3, 5.9.3, 6.0.3, 6.1.4, 6.2.4, 6.3.6, 6.4.5, 6.5.3, 6.6.4, 6.7.3, 6.8.4, 6.9.3, 7.0.4, 7.1.4, 7.2.4, 7.3.4, 7.4.4, 7.5.6, 7.6.3, 7.7.5, 7.8.3, 7.9.3, 8.0.2, 8.1.3, 8.2.5, 8.3.2, 8.4.4, 8.5.2, 8.6.3, 8.7.3, 8.8.4, 8.9.3, 9.0.4, 9.1.2, 9.2.3, 9.3.4, 9.4.3, 9.5.4, 9.6.3, 9.7.2, 9.8.2, 9.9.2, 10.0.1, 10.1.1, 10.2.2, 10.3.1, 10.4.1, 10.5.2, 10.6.2, 10.7.1, 10.8.1, 10.9.2, 11.0.1, 11.1.3, 11.2.1, 11.3.3, 11.4.1, 11.5.2, 11.6.1, 11.7.2, 11.8.5, 11.9.2, 12.0.1, 12.1.1
What to do
If your site has an affected version, update Jetpack – AI Agents & MCP, Security, Backup & Analytics to version 12.1.1 or newer.
Official ID
CVE-2023-2996
Report title
Jetpack <= 12.1 - Authenticated (Author+) Arbitrary File Manipulation
First reported
Sources
This week

Someone could use it to harm your site (from 2.0 up to, but not including, 2.0.8; from 2.1 up to, but not including, 2.1.6; from 2.2 up to, but not including, 2.2.9; from 2.3 up to, but not including, 2.3.9; from 2.4 up to, but not including, 2.4.6; from 2.5 up to, but not including, 2.5.4; from 2.6 up to, but not including, 2.6.5; from 2.7 up to, but not including, 2.7.4; from 2.8 up to, but not including, 2.8.4; from 2.9 up to, but not including, 2.9.5; from 3.0 up to, but not including, 3.0.5; from 3.1 up to, but not including, 3.1.4; from 3.2 up to, but not including, 3.2.4; from 3.3 up to, but not including, 3.3.5; from 3.4 up to, but not including, 3.4.5; from 3.5 up to, but not including, 3.5.5; from 3.6 up to, but not including, 3.6.3; from 3.7 up to, but not including, 3.7.4; from 3.8 up to, but not including, 3.8.4; from 3.9 up to, but not including, 3.9.8; from 4.0 up to, but not including, 4.0.5; from 4.1 up to, but not including, 4.1.2; from 4.2 up to, but not including, 4.2.3; from 4.3 up to, but not including, 4.3.3; from 4.4 up to, but not including, 4.4.3; from 4.5 up to, but not including, 4.5.1; from 4.6 up to, but not including, 4.6.1; from 4.7 up to, but not including, 4.7.2; from 4.8 up to, but not including, 4.8.3; from 4.9 up to, but not including, 4.9.1; from 5.0 up to, but not including, 5.0.1; from 5.1 up to, but not including, 5.1.2; from 5.2 up to, but not including, 5.2.3; from 5.3 up to, but not including, 5.3.2; from 5.4 up to, but not including, 5.4.2; from 5.5 up to, but not including, 5.5.3; from 5.6 up to, but not including, 5.6.3; from 5.7 up to, but not including, 5.7.3; from 5.8 up to, but not including, 5.8.2; from 5.9 up to, but not including, 5.9.2; from 6.0 up to, but not including, 6.0.2; from 6.1 up to, but not including, 6.1.3; from 6.2 up to, but not including, 6.2.3; from 6.3 up to, but not including, 6.3.5; from 6.4 up to, but not including, 6.4.4; from 6.5 up to, but not including, 6.5.2; from 6.6 up to, but not including, 6.6.3; from 6.7 up to, but not including, 6.7.2; from 6.8 up to, but not including, 6.8.3; from 6.9 up to, but not including, 6.9.2; from 7.0 up to, but not including, 7.0.3; from 7.1 up to, but not including, 7.1.3; from 7.2 up to, but not including, 7.2.3; from 7.3 up to, but not including, 7.3.3; from 7.4 up to, but not including, 7.4.3; from 7.5 up to, but not including, 7.5.5; from 7.6 up to, but not including, 7.6.2; from 7.7 up to, but not including, 7.7.4; from 7.8 up to, but not including, 7.8.2; from 7.9 up to, but not including, 7.9.2; from 8.0 up to, but not including, 8.0.1; from 8.1 up to, but not including, 8.1.2; from 8.2 up to, but not including, 8.2.4; from 8.3 up to, but not including, 8.3.1; from 8.4 up to, but not including, 8.4.3; from 8.5 up to, but not including, 8.5.1; from 8.6 up to, but not including, 8.6.2; from 8.7 up to, but not including, 8.7.2; from 8.8 up to, but not including, 8.8.3; from 8.9 up to, but not including, 8.9.2; from 9.0 up to, but not including, 9.0.3; from 9.1 up to, but not including, 9.1.1; from 9.2 up to, but not including, 9.2.2; from 9.3 up to, but not including, 9.3.3; from 9.4 up to, but not including, 9.4.2; from 9.5 up to, but not including, 9.5.3; from 9.6 up to, but not including, 9.6.2; from 9.7 up to, but not including, 9.7.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • From 2.0 up to, but not including, 2.0.8
  • From 2.1 up to, but not including, 2.1.6
  • From 2.2 up to, but not including, 2.2.9
  • From 2.3 up to, but not including, 2.3.9
  • From 2.4 up to, but not including, 2.4.6
  • From 2.5 up to, but not including, 2.5.4
  • From 2.6 up to, but not including, 2.6.5
  • From 2.7 up to, but not including, 2.7.4
  • From 2.8 up to, but not including, 2.8.4
  • From 2.9 up to, but not including, 2.9.5
  • From 3.0 up to, but not including, 3.0.5
  • From 3.1 up to, but not including, 3.1.4
  • From 3.2 up to, but not including, 3.2.4
  • From 3.3 up to, but not including, 3.3.5
  • From 3.4 up to, but not including, 3.4.5
  • From 3.5 up to, but not including, 3.5.5
  • From 3.6 up to, but not including, 3.6.3
  • From 3.7 up to, but not including, 3.7.4
  • From 3.8 up to, but not including, 3.8.4
  • From 3.9 up to, but not including, 3.9.8
  • From 4.0 up to, but not including, 4.0.5
  • From 4.1 up to, but not including, 4.1.2
  • From 4.2 up to, but not including, 4.2.3
  • From 4.3 up to, but not including, 4.3.3
  • From 4.4 up to, but not including, 4.4.3
  • From 4.5 up to, but not including, 4.5.1
  • From 4.6 up to, but not including, 4.6.1
  • From 4.7 up to, but not including, 4.7.2
  • From 4.8 up to, but not including, 4.8.3
  • From 4.9 up to, but not including, 4.9.1
  • From 5.0 up to, but not including, 5.0.1
  • From 5.1 up to, but not including, 5.1.2
  • From 5.2 up to, but not including, 5.2.3
  • From 5.3 up to, but not including, 5.3.2
  • From 5.4 up to, but not including, 5.4.2
  • From 5.5 up to, but not including, 5.5.3
  • From 5.6 up to, but not including, 5.6.3
  • From 5.7 up to, but not including, 5.7.3
  • From 5.8 up to, but not including, 5.8.2
  • From 5.9 up to, but not including, 5.9.2
  • From 6.0 up to, but not including, 6.0.2
  • From 6.1 up to, but not including, 6.1.3
  • From 6.2 up to, but not including, 6.2.3
  • From 6.3 up to, but not including, 6.3.5
  • From 6.4 up to, but not including, 6.4.4
  • From 6.5 up to, but not including, 6.5.2
  • From 6.6 up to, but not including, 6.6.3
  • From 6.7 up to, but not including, 6.7.2
  • From 6.8 up to, but not including, 6.8.3
  • From 6.9 up to, but not including, 6.9.2
  • From 7.0 up to, but not including, 7.0.3
  • From 7.1 up to, but not including, 7.1.3
  • From 7.2 up to, but not including, 7.2.3
  • From 7.3 up to, but not including, 7.3.3
  • From 7.4 up to, but not including, 7.4.3
  • From 7.5 up to, but not including, 7.5.5
  • From 7.6 up to, but not including, 7.6.2
  • From 7.7 up to, but not including, 7.7.4
  • From 7.8 up to, but not including, 7.8.2
  • From 7.9 up to, but not including, 7.9.2
  • From 8.0 up to, but not including, 8.0.1
  • From 8.1 up to, but not including, 8.1.2
  • From 8.2 up to, but not including, 8.2.4
  • From 8.3 up to, but not including, 8.3.1
  • From 8.4 up to, but not including, 8.4.3
  • From 8.5 up to, but not including, 8.5.1
  • From 8.6 up to, but not including, 8.6.2
  • From 8.7 up to, but not including, 8.7.2
  • From 8.8 up to, but not including, 8.8.3
  • From 8.9 up to, but not including, 8.9.2
  • From 9.0 up to, but not including, 9.0.3
  • From 9.1 up to, but not including, 9.1.1
  • From 9.2 up to, but not including, 9.2.2
  • From 9.3 up to, but not including, 9.3.3
  • From 9.4 up to, but not including, 9.4.2
  • From 9.5 up to, but not including, 9.5.3
  • From 9.6 up to, but not including, 9.6.2
  • From 9.7 up to, but not including, 9.7.1
Fixed in
2.0.8, 2.1.6, 2.2.9, 2.3.9, 2.4.6, 2.5.4, 2.6.5, 2.7.4, 2.8.4, 2.9.5, 3.0.5, 3.1.4, 3.2.4, 3.3.5, 3.4.5, 3.5.5, 3.6.3, 3.7.4, 3.8.4, 3.9.8, 4.0.5, 4.1.2, 4.2.3, 4.3.3, 4.4.3, 4.5.1, 4.6.1, 4.7.2, 4.8.3, 4.9.1, 5.0.1, 5.1.2, 5.2.3, 5.3.2, 5.4.2, 5.5.3, 5.6.3, 5.7.3, 5.8.2, 5.9.2, 6.0.2, 6.1.3, 6.2.3, 6.3.5, 6.4.4, 6.5.2, 6.6.3, 6.7.2, 6.8.3, 6.9.2, 7.0.3, 7.1.3, 7.2.3, 7.3.3, 7.4.3, 7.5.5, 7.6.2, 7.7.4, 7.8.2, 7.9.2, 8.0.1, 8.1.2, 8.2.4, 8.3.1, 8.4.3, 8.5.1, 8.6.2, 8.7.2, 8.8.3, 8.9.2, 9.0.3, 9.1.1, 9.2.2, 9.3.3, 9.4.2, 9.5.3, 9.6.2, 9.7.1
What to do
If your site has an affected version, update Jetpack – AI Agents & MCP, Security, Backup & Analytics to version 9.7.1 or newer.
Official ID
CVE-2021-24374
Report title
JetPack <= 9.7 - Information Disclosure
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 5.1; from 5.1 up to, but not including, 5.1.1; from 5.2 up to, but not including, 5.2.2; from 5.3 up to, but not including, 5.3.1; from 5.4 up to, but not including, 5.4.1; from 5.5 up to, but not including, 5.5.2; from 5.6 up to, but not including, 5.6.2; from 5.7 up to, but not including, 5.7.2; from 5.8 up to, but not including, 5.8.1; from 5.9 up to, but not including, 5.9.1; from 6.0 up to, but not including, 6.0.1; from 6.1 up to, but not including, 6.1.2; from 6.2 up to, but not including, 6.2.2; from 6.3 up to, but not including, 6.3.4; from 6.4 up to, but not including, 6.4.3; from 6.5 up to, but not including, 6.5.1; from 6.6 up to, but not including, 6.6.2; from 6.7 up to, but not including, 6.7.1; from 6.8 up to, but not including, 6.8.2; from 6.9 up to, but not including, 6.9.1; from 7.0 up to, but not including, 7.0.2; from 7.1 up to, but not including, 7.1.2; from 7.2 up to, but not including, 7.2.2; from 7.3 up to, but not including, 7.3.2; from 7.4 up to, but not including, 7.4.2; from 7.5 up to, but not including, 7.5.4; from 7.6 up to, but not including, 7.6.1; from 7.7 up to, but not including, 7.7.3; from 7.8 up to, but not including, 7.8.1; from 7.9 up to, but not including, 7.9.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 5.1
  • From 5.1 up to, but not including, 5.1.1
  • From 5.2 up to, but not including, 5.2.2
  • From 5.3 up to, but not including, 5.3.1
  • From 5.4 up to, but not including, 5.4.1
  • From 5.5 up to, but not including, 5.5.2
  • From 5.6 up to, but not including, 5.6.2
  • From 5.7 up to, but not including, 5.7.2
  • From 5.8 up to, but not including, 5.8.1
  • From 5.9 up to, but not including, 5.9.1
  • From 6.0 up to, but not including, 6.0.1
  • From 6.1 up to, but not including, 6.1.2
  • From 6.2 up to, but not including, 6.2.2
  • From 6.3 up to, but not including, 6.3.4
  • From 6.4 up to, but not including, 6.4.3
  • From 6.5 up to, but not including, 6.5.1
  • From 6.6 up to, but not including, 6.6.2
  • From 6.7 up to, but not including, 6.7.1
  • From 6.8 up to, but not including, 6.8.2
  • From 6.9 up to, but not including, 6.9.1
  • From 7.0 up to, but not including, 7.0.2
  • From 7.1 up to, but not including, 7.1.2
  • From 7.2 up to, but not including, 7.2.2
  • From 7.3 up to, but not including, 7.3.2
  • From 7.4 up to, but not including, 7.4.2
  • From 7.5 up to, but not including, 7.5.4
  • From 7.6 up to, but not including, 7.6.1
  • From 7.7 up to, but not including, 7.7.3
  • From 7.8 up to, but not including, 7.8.1
  • From 7.9 up to, but not including, 7.9.1
Fixed in
5.1.1, 5.2.2, 5.3.1, 5.4.1, 5.5.2, 5.6.2, 5.7.2, 5.8.1, 5.9.1, 6.0.1, 6.1.2, 6.2.2, 6.3.4, 6.4.3, 6.5.1, 6.6.2, 6.7.1, 6.8.2, 6.9.1, 7.0.2, 7.1.2, 7.2.2, 7.3.2, 7.4.2, 7.5.4, 7.6.1, 7.7.3, 7.8.1, 7.9.1
What to do
If your site has an affected version, update Jetpack – AI Agents & MCP, Security, Backup & Analytics to version 7.9.1 or newer.
Report title
Jetpack <= 7.9 - Stored Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 7.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 7.0
Fixed in
7.0.1
What to do
If your site has an affected version, update Jetpack – AI Agents & MCP, Security, Backup & Analytics to version 7.0.1 or newer.
Report title
Jetpack < 7.0.1 - Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 6.4.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 6.4.2
Fixed in
6.5
What to do
If your site has an affected version, update Jetpack – AI Agents & MCP, Security, Backup & Analytics to version 6.5 or newer.
Report title
Jetpack <= 6.4.2 - Cross-Site Scripting via post_meta
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 4.0.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 4.0.3
Fixed in
4.0.3
What to do
If your site has an affected version, update Jetpack – AI Agents & MCP, Security, Backup & Analytics to version 4.0.3 or newer.
Official ID
CVE-2016-10706
Report title
Jetpack <= 4.0.2 - Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 4.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 4.2
Fixed in
4.2
What to do
If your site has an affected version, update Jetpack – AI Agents & MCP, Security, Backup & Analytics to version 4.2 or newer.
Report title
Jetpack – WP Security, Backup, Speed, & Growth < 4.2 - Reflected Cross-Site Scripting
First reported
Sources
This week

Someone could use it to harm your site (before 4.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 4.2
Fixed in
4.2
What to do
If your site has an affected version, update Jetpack – AI Agents & MCP, Security, Backup & Analytics to version 4.2 or newer.
Report title
Jetpack – WP Security, Backup, Speed, & Growth < 4.2 - CSV Injection
First reported
Sources
This week

Someone could use it to harm your site (before 4.2) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 4.2
Fixed in
4.2
What to do
If your site has an affected version, update Jetpack – AI Agents & MCP, Security, Backup & Analytics to version 4.2 or newer.
Report title
Jetpack – WP Security, Backup, Speed, & Growth < 4.2 - Timing Attack
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 4.0.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 4.0.4
Fixed in
4.0.4
What to do
If your site has an affected version, update Jetpack – AI Agents & MCP, Security, Backup & Analytics to version 4.0.4 or newer.
Official ID
CVE-2016-10705
Report title
Jetpack <= 4.0.3 - Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 3.9.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.9.1
Fixed in
3.9.2
What to do
If your site has an affected version, update Jetpack – AI Agents & MCP, Security, Backup & Analytics to version 3.9.2 or newer.
Report title
Jetpack – WP Security, Backup, Speed, & Growth <= 3.9.1 - Cross-Site Scripting via LaTeX markup within HTML elements
First reported
Sources
This week

Someone could use it to harm your site (up to and including 3.9.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.9.1
Fixed in
3.9.2
What to do
If your site has an affected version, update Jetpack – AI Agents & MCP, Security, Backup & Analytics to version 3.9.2 or newer.
Report title
Jetpack – WP Security, Backup, Speed, & Growth <= 3.9.1 - Sensitive Information Disclosure
First reported
Sources
This week

Someone could use it to harm your site (up to and including 3.7.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.7.1
Fixed in
3.7.2
What to do
If your site has an affected version, update Jetpack – AI Agents & MCP, Security, Backup & Analytics to version 3.7.2 or newer.
Report title
Jetpack <= 3.7.1 - Information disclosure
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 3.7.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.7.1
Fixed in
3.7.2
What to do
If your site has an affected version, update Jetpack – AI Agents & MCP, Security, Backup & Analytics to version 3.7.2 or newer.
Report title
Jetpack <= 3.7.1 - Stored Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 3.5.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.5.2
Fixed in
3.5.3
What to do
If your site has an affected version, update Jetpack – AI Agents & MCP, Security, Backup & Analytics to version 3.5.3 or newer.
Report title
Jetpack <= 3.5.2 - Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 3.4.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 3.4.3
Fixed in
3.4.3
What to do
If your site has an affected version, update Jetpack – AI Agents & MCP, Security, Backup & Analytics to version 3.4.3 or newer.
Official ID
CVE-2015-9359
Report title
Jetpack <= 3.4.2 - Reflected Cross-Site Scripting
First reported
Sources
This week

Someone could use it to harm your site (up to and including 1.8; from 1.9 up to and including 1.9.3; from 2.0 up to and including 2.0.8; from 2.1 up to and including 2.1.3; from 2.2 up to and including 2.2.6; from 2.3 up to and including 2.3.6; from 2.4 up to and including 2.4.3; from 2.5 up to and including 2.5.1; from 2.6 up to and including 2.6.2; from 2.7 up to and including 2.7.1; from 2.8 up to and including 2.8.1; from 2.9 up to and including 2.9.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.8
  • From 1.9 up to and including 1.9.3
  • From 2.0 up to and including 2.0.8
  • From 2.1 up to and including 2.1.3
  • From 2.2 up to and including 2.2.6
  • From 2.3 up to and including 2.3.6
  • From 2.4 up to and including 2.4.3
  • From 2.5 up to and including 2.5.1
  • From 2.6 up to and including 2.6.2
  • From 2.7 up to and including 2.7.1
  • From 2.8 up to and including 2.8.1
  • From 2.9 up to and including 2.9.2
Fixed in
1.9.4, 2.0.9, 2.1.4, 2.2.7, 2.3.7, 2.4.4, 2.5.2, 2.6.3, 2.7.2, 2.8.2, 2.9.3
What to do
If your site has an affected version, update Jetpack – AI Agents & MCP, Security, Backup & Analytics to version 2.9.3 or newer.
Official ID
CVE-2014-0173
Report title
Jetpack < 2.9.3 - Security Bypass
First reported
Sources

Where this comes from

We collect these reports from public security sources and rewrite them in plain words. Each problem shows its sources and the date we first saw it. This page never says whether your own site is affected: only a check of your site’s versions can tell.

All plugins and themes

Get an email when your site is affected.

Install Watchfox AI once. It checks your plugins and themes against this list every day, for free.

Install Watchfox AI (free)