WP Vulnerability WatchVulnerability data as of September 7, 2026

Known vulnerabilities in Jetpack – WP Security, Backup, Speed, & Growth

Improve your WP security with powerful one-click tools like backup, WAF, and malware scan. Includes free tools like stats, CDN and social sharing.

29Reported vulnerabilities
9.8Highest CVSS score
16.1.1Latest version
3,000,000+Active installs

What to do now

Update Jetpack – WP Security, Backup, Speed, & Growth to 12.0.3 or later. 28 of these have a fixed version available. Updating resolves them.

Plugin last updated: August 11, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVESeverityExploit probability
next 30 days		 Affected versionsFixed inPublished
CVE-2023-2996 High 8.8 4.8% Before 12.1.1 12.1.1 June 27, 2023
CVE-2024-10858 Medium 6.1 0.4% Before 14.1 14.1 December 25, 2024
CVE-2024-10075 Medium 5.6 0.4% Before 13.8 13.8 May 15, 2025
CVE-2021-24374 Medium 5.3 1.5% Before 9.8 9.8 June 21, 2021
WF-fc6dcf93-7f1f-4e87-8ba5-852d23b1f0fd Critical 9.8 — Before 4.2 4.2 April 26, 2017
WF-f4703ca7-0677-4128-b9b7-31132ff1804d Critical 9.6 — Before 4.2 4.2 April 26, 2017
CVE-2024-9926 Medium 4.3 1.3% 13.1 up to (but not including) 13.1.4
13.2 up to (but not including) 13.2.3
13.3 up to (but not including) 13.3.2
13.4 up to (but not including) 13.4.4
13.8 up to (but not including) 13.8.2
13.0 to 13.0 (inclusive)
13.5 to 13.5 (inclusive)
13.6 to 13.6 (inclusive)
13.7 to 13.7 (inclusive)
13.9 to 13.9 (inclusive)		 13.1.4 November 7, 2024
WF-72f4776f-5450-4022-92dd-47ddaa91a5cd High 7.2 — 12.0 to 12.0.2 (inclusive)
12.1 to 12.1.2 (inclusive)
12.2 to 12.2.2 (inclusive)
12.3 to 12.3.1 (inclusive)
12.4 to 12.4.1 (inclusive)
12.5 to 12.5.1 (inclusive)
12.6 to 12.6.3 (inclusive)
12.7 to 12.7.2 (inclusive)
12.8 to 12.8.2 (inclusive)
12.9 to 12.9.4 (inclusive)
13.0 to 13.0.1 (inclusive)
13.1 to 13.1.4 (inclusive)
13.2 to 13.2.3 (inclusive)
13.3 to 13.3.2 (inclusive)
13.4 to 13.4.4 (inclusive)
13.5 to 13.5.1 (inclusive)
13.6 to 13.6.1 (inclusive)
13.7 to 13.7.1 (inclusive)
13.8 to 13.8.2 (inclusive)
13.9 to 13.9.1 (inclusive)
14.0 to 14.0 (inclusive)
14.1 to 14.1 (inclusive)
14.2 to 14.2.1 (inclusive)
14.3 to 14.3 (inclusive)
14.4 to 14.4.1 (inclusive)
14.5 to 14.5 (inclusive)
14.6 to 14.6 (inclusive)
14.7 to 14.7 (inclusive)
14.8 to 14.8 (inclusive)
14.9 to 14.9.1 (inclusive)
15.0 to 15.0.2 (inclusive)
15.1 to 15.1.1 (inclusive)
15.2 to 15.2 (inclusive)
15.3 to 15.3.1 (inclusive)
15.4 to 15.4 (inclusive)
15.5 to 15.5 (inclusive)
15.6 to 15.6 (inclusive)
15.7 to 15.7.1 (inclusive)
15.8 to 15.8 (inclusive)
15.9 to 15.9.1 (inclusive)
16.0 to 16.0.1 (inclusive)
16.1 to 16.1.2 (inclusive)		 12.0.3 September 3, 2026
WF-a1c731b9-8862-4140-b5e8-58132113e22c High 7.2 — 3.7.1 and earlier 3.7.2 October 1, 2015
WF-d8616189-5ab8-4db0-ab9e-768cc738aeb6 High 7.2 — 3.5.2 and earlier 3.5.3 May 6, 2015
CVE-2014-0173 Medium 5.8 2.3% 1.9 to 1.9 (inclusive)
1.9.1 to 1.9.1 (inclusive)
1.9.2 to 1.9.2 (inclusive)
2.0 to 2.0 (inclusive)
2.0.1 to 2.0.1 (inclusive)
2.0.2 to 2.0.2 (inclusive)
2.0.3 to 2.0.3 (inclusive)
2.0.4 to 2.0.4 (inclusive)
2.1 to 2.1 (inclusive)
2.1.1 to 2.1.1 (inclusive)
2.1.2 to 2.1.2 (inclusive)
2.2 to 2.2 (inclusive)
2.2.1 to 2.2.1 (inclusive)
2.2.2 to 2.2.2 (inclusive)
2.2.3 to 2.2.3 (inclusive)
2.2.4 to 2.2.4 (inclusive)
2.2.5 to 2.2.5 (inclusive)
2.3 to 2.3 (inclusive)
2.3.1 to 2.3.1 (inclusive)
2.3.2 to 2.3.2 (inclusive)
2.3.3 to 2.3.3 (inclusive)
2.3.4 to 2.3.4 (inclusive)
2.3.5 to 2.3.5 (inclusive)
2.4 to 2.4 (inclusive)
2.4.1 to 2.4.1 (inclusive)
2.4.2 to 2.4.2 (inclusive)
2.5 to 2.5 (inclusive)
2.6 to 2.6 (inclusive)
2.6.1 to 2.6.1 (inclusive)
2.7 to 2.7 (inclusive)
2.8 to 2.8 (inclusive)
2.9 to 2.9 (inclusive)
2.9.1 to 2.9.1 (inclusive)
2.9.2 to 2.9.2 (inclusive)
2.9.3 to 2.9.3 (inclusive)		 1.9.4 April 22, 2014
CVE-2023-45050 Medium 6.4 0.6% 12.8-a.1 and earlier 12.8-a.3 November 16, 2023
WF-5287cf42-6d0a-4fd2-943d-e8e44fc08576 Medium 6.4 — Before 5.1
5.1 up to (but not including) 5.1.1
5.2 up to (but not including) 5.2.2
5.3 up to (but not including) 5.3.1
5.4 up to (but not including) 5.4.1
5.5 up to (but not including) 5.5.2
5.6 up to (but not including) 5.6.2
5.7 up to (but not including) 5.7.2
5.8 up to (but not including) 5.8.1
5.9 up to (but not including) 5.9.1
6.0 up to (but not including) 6.0.1
6.1 up to (but not including) 6.1.2
6.2 up to (but not including) 6.2.2
6.3 up to (but not including) 6.3.4
6.4 up to (but not including) 6.4.3
6.5 up to (but not including) 6.5.1
6.6 up to (but not including) 6.6.2
6.7 up to (but not including) 6.7.1
6.8 up to (but not including) 6.8.2
6.9 up to (but not including) 6.9.1
7.0 up to (but not including) 7.0.2
7.1 up to (but not including) 7.1.2
7.2 up to (but not including) 7.2.2
7.3 up to (but not including) 7.3.2
7.4 up to (but not including) 7.4.2
7.5 up to (but not including) 7.5.4
7.6 up to (but not including) 7.6.1
7.7 up to (but not including) 7.7.3
7.8 up to (but not including) 7.8.1
7.9 up to (but not including) 7.9.1		 5.1.1 October 19, 2019
CVE-2015-9359 Medium 6.1 0.9% Before 3.4.3 3.4.3 August 28, 2019
CVE-2016-10706 Medium 6.1 1.0% Before 4.0.3 4.0.3 January 12, 2018
CVE-2016-10705 Medium 6.1 1.0% 4.0.3 and earlier 4.0.4 January 12, 2018
WF-eda9ae01-cdc4-43e0-8a4c-1ec365939fa8 Medium 6.1 — 14.5 to 14.5 (inclusive)
14.6 to 14.6 (inclusive)
14.7 to 14.7 (inclusive)
14.8 to 14.8 (inclusive)
14.9 to 14.9.1 (inclusive)
15.0 to 15.0.2 (inclusive)
15.1 to 15.1.1 (inclusive)
15.2 to 15.2 (inclusive)
15.3 to 15.3.1 (inclusive)
15.4 to 15.4 (inclusive)
15.5 to 15.5 (inclusive)
15.6 to 15.6 (inclusive)
15.7 to 15.7.1 (inclusive)
15.8 to 15.8 (inclusive)
15.9 to 15.9.1 (inclusive)
16.0 to 16.0.1 (inclusive)
16.1 to 16.1.2 (inclusive)		 14.5.1 September 3, 2026
WF-5083509e-84e4-4bd3-9023-b458312b1886 Medium 6.1 — 7.0 and earlier 7.0.1 February 14, 2019
WF-35293a82-b535-47a2-8a34-e54fe836ca89 Medium 6.1 — Before 4.2 4.2 April 26, 2017
WF-0691cff0-86ed-47d3-9492-5ebc930d3eb7 Medium 6.1 — 3.9.1 and earlier 3.9.2 February 25, 2016
CVE-2024-10076 Medium 5.9 0.3% Before 13.8
Before 3.4.8		 13.8 May 15, 2025
CVE-2024-4392 Medium 5.4 0.4% Before 13.4 13.4 May 14, 2024
WF-d703abc2-3269-42b2-a75c-d163df62260d Medium 5.4 — 6.4.2 and earlier 6.5 December 11, 2018
WF-72094f97-c1cc-48df-9c88-1352e6d6e67e Medium 5.3 — 3.7.1 and earlier 3.7.2 October 1, 2015
CVE-2022-50958 Medium 5.1 0.2% — — May 10, 2026
CVE-2023-47774 Medium 5 0.3% Before 12.7 12.7 November 16, 2023
WF-9b86a259-b102-411a-8d4c-c131737b90d8 Medium 4.9 — 3.9.1 and earlier 3.9.2 February 25, 2016
WF-f72c0a27-9602-4465-a14a-15c2a34e578b Medium 4.3 — 3.2 to 16.1.2 (inclusive) 16.1.3 September 3, 2026
CVE-2023-47788 Medium 4.3 0.4% Before 12.7 12.7 November 16, 2023

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.