WP Vulnerability WatchVulnerability data as of September 7, 2026

Known vulnerabilities in ActivityPub

Connect your site to the Open Social Web and let millions of users follow, share, and interact with your content from Mastodon, Pixelfed, and more.

6Reported vulnerabilities
7.5Highest CVSS score
9.2.2Latest version
6,000+Active installs

What to do now

Update ActivityPub to 8.0.2 or later. 6 of these have a fixed version available. Updating resolves them.

Plugin last updated: August 11, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVESeverityExploit probability
next 30 days		 Affected versionsFixed inPublished
CVE-2023-5057 Medium 5.4 0.4% Before 1.0.0 1.0.0 October 16, 2023
CVE-2023-3746 Medium 5.4 0.4% Before 1.0.0 1.0.0 October 16, 2023
CVE-2023-3707 Medium 4.3 0.5% Before 1.0.0 1.0.0 October 16, 2023
CVE-2023-3706 Medium 4.3 0.5% Before 1.0.0 1.0.0 October 16, 2023
CVE-2026-4338 High 7.5 0.4% Before 8.0.2 8.0.2 April 8, 2026
CVE-2023-52199 Medium 5.3 0.3% 1.0.5 and earlier 1.0.6 January 5, 2024

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.