Jetpack · Security record

Is Jetpack safe?

One known vulnerability affects the current version (16.4), and it has no fix yet.

Checked 4 days ago against the WPVulnerability database, for version 16.4.

How it’s looked after

Last release: Nov 3, 2026 (5 days ago)
Releases in the last year: 66
Tested up to: WordPress 7.1.4
Support resolved: 57 of 68 threads in two months
Active installs: 3M+

48 known vulnerabilities

1 high
16 medium
31 not rated

1 affects the current version. 1 has no fix yet.

Disclosed each year

20111
20131
20158
20166
20174
20182
20193
20211
20235
20245
20265

Every known vulnerability in Jetpack

Newest first, with any that affect the current version at the top.

medium
WordPress Plugin Jetpack 9.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malici…
Affects the current version · No fix yet · CVE-2022-50958 · May 10, 2026 · CVE
medium
Authentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack allows Password Recovery Exploitation.
Fixed in 16.3 · CVE-2026-106601 · Oct 9, 2026 · CVE
medium
Authentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack allows Password Recovery Exploitation.
Fixed in 16.3 · CVE-2026-106602 · Oct 9, 2026 · CVE
Authenticated (Administrator+) PHP Object Injection
Fixed in 16.1.3 · Sep 3, 2026 · Wordfence
medium
Cross-site Scripting
Affects 11.4 and earlier · CVE-2023-54332 · Jan 13, 2026 · CVE
medium
Reflected DOM-based Cross-Site Scripting
Fixed in 16.1.3 · CVE-2024-10858 · Dec 4, 2024 · Wordfence
medium
Unauthenticated Arbitrary Block & Shortcode Execution
Fixed in 13.8 · CVE-2024-10075 · Oct 17, 2024 · Wordfence
medium
Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in 13.8 · CVE-2024-10076 · Oct 17, 2024 · Wordfence
medium
Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure
Fixed in 13.9.1 · CVE-2024-9926 · Oct 14, 2024 · Wordfence
medium
Authenticated (Contributor+) Stored Cross-Site Scripting via wpvideo Shortcode
Fixed in 13.4 · CVE-2024-4392 · May 13, 2024 · Wordfence
medium
Authenticated (Contributor+) Stored Cross-Site Scripting via block attribute
Fixed in 12.8-a.3 · CVE-2023-45050 · Nov 15, 2023 · Wordfence
medium
Improper Authorization via WPCom External Media REST endpoints
Fixed in 12.7 · CVE-2023-47788 · Nov 15, 2023 · Wordfence
medium
Authenticated(Contributor+) Clickjacking via Iframe Injection
Fixed in 12.7 · CVE-2023-47774 · Nov 15, 2023 · Wordfence
high
Authenticated (Author+) Arbitrary File Manipulation
Fixed in 12.1.1 · CVE-2023-2996 · May 30, 2023 · Wordfence
WordPress Jetpack Plugin <= 12.1 is vulnerable to Broken Access Control
Fixed in 12.1.1 · May 30, 2023 · Patchstack
medium
Information Disclosure
Fixed in 9.8 · CVE-2021-24374 · Jun 1, 2021 · Wordfence
Shortcode embedding system vulnerability
Fixed in 7.9.1 · Nov 21, 2019 · Patchstack
Stored Cross-Site Scripting
Affects 7.9 and earlier · Oct 19, 2019 · Wordfence
Cross-Site Scripting
Fixed in 7.0.1 · Feb 14, 2019 · Wordfence
Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Fixed in 6.5 · Dec 12, 2018 · Patchstack
Cross-Site Scripting via post_meta
Fixed in 6.5 · Dec 11, 2018 · Wordfence
Timing Attack
Fixed in 4.2 · Apr 26, 2017 · Wordfence
CSV Injection
Fixed in 4.2 · Apr 26, 2017 · Wordfence
Reflected Cross-Site Scripting
Fixed in 4.2 · Apr 26, 2017 · Wordfence
medium
Cross-Site Scripting
Fixed in 4.0.3 · CVE-2016-10706 · Apr 26, 2017 · Wordfence
Multiple Vulnerabilities
Fixed in 4.0.4 · Jun 20, 2016 · Patchstack
medium
Cross-Site Scripting
Fixed in 4.0.4 · CVE-2016-10705 · Jun 20, 2016 · Wordfence
Stored Cross Site Scripting
Fixed in 4.0.3 · May 26, 2016 · Patchstack
Sensitive Information Disclosure
Fixed in 3.9.2 · Feb 25, 2016 · Wordfence
Cross-Site Scripting via LaTeX markup within HTML elements
Fixed in 3.9.2 · Feb 25, 2016 · Wordfence
Cross Site Scripting
Fixed in 3.9.2 · Feb 25, 2016 · Patchstack
Stored Cross-Site Scripting
Fixed in 3.7.2 · Oct 1, 2015 · Wordfence
Information disclosure
Fixed in 3.7.2 · Oct 1, 2015 · Wordfence
Information Disclosure
Fixed in 3.7.1 · Oct 1, 2015 · Patchstack
Stored Cross Site Scripting
Fixed in 3.7.1 · Oct 1, 2015 · Patchstack
Cross-Site Scripting
Fixed in 3.5.3 · May 6, 2015 · Wordfence
Cross Site Scripting
Fixed in 3.5.3 · May 6, 2015 · Patchstack
Cross Site Scripting
Fixed in 3.4.3 · Apr 20, 2015 · Patchstack
medium
Reflected Cross-Site Scripting
Fixed in 3.4.3 · CVE-2015-9359 · Apr 20, 2015 · Wordfence
Security Bypass
Fixed in 2.9.3 · CVE-2014-0173 · Dec 3, 2013 · Wordfence
SQL Injection
Affects 1.1.3 and earlier · CVE-2011-4673 · Nov 19, 2011 · Patchstack
Contributor+ Stored XSS
Fixed in 13.2.1 · WPScan
Unauthenticated DOM Cross-Site Scripting (XSS)
Fixed in 3.5.3 · WPScan
Stored Cross-Site Scripting (XSS)
Fixed in 3.7.1 · WPScan
Information Disclosure
Fixed in 3.7.1 · WPScan
LaTeX HTML Element XSS
Fixed in 3.9.2 · WPScan
Authenticated Stored Cross-Site Scripting (XSS)
Fixed in 6.5 · WPScan
Vulnerability in Shortcode Embed Code
Affects 7.9 and earlier · WPScan

Questions about Jetpack’s security

Is Jetpack safe to use?

Yes: 1 known vulnerability affects version 16.4, according to WPVulnerability’s database. Until a fixed version is out, weigh the risk, or switch to an alternative.

Does Jetpack have known security vulnerabilities?

Yes: 1 known vulnerability affects version 16.4, according to WPVulnerability’s database.

Is Jetpack still maintained?

Yes. Its last release was 5 days ago. Its authors resolved 57 of the 68 support threads opened in the last two months.

Is Jetpack compatible with the latest WordPress?

Yes. It’s tested up to WordPress 7.1.4, the current version.

Hear about the next one first

Track your plugin on TrackWP and get an alert when a new vulnerability affecting it is published. Every plan has it, the free Starter too; Boost and FullCharge email it at once.

Start free

Vulnerability data from WPVulnerability (CC0), which gathers records from CVE, Wordfence, Patchstack and WPScan. A clean record isn’t a guarantee: keep every plugin updated.