Known vulnerabilities in Jetpack CRM – Clients, Leads, Invoices, Billing, Email Marketing, & Automation

The CRM for small businesses. Manage leads, invoicing, billing, email marketing, clients, contacts, quotes, automation. Works with WooCommerce too.

5Reported vulnerabilities

8.8Highest CVSS score

6.8.2Latest version

30,000+Active installs

What to do now

Update Jetpack CRM – Clients, Leads, Invoices, Billing, Email Marketing, & Automation to 6.7.1 or later. 5 of these have a fixed version available. Updating resolves them.

Plugin last updated: July 27, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
CVE-2022-3342	High 8.8	1.0%	5.3.1 and earlier	`5.4.0`	October 20, 2023
CVE-2026-22356	High 8.1	0.4%	6.7.0 and earlier	`6.7.1`	February 16, 2026
WF-e1dbd0e2-8c6c-4127-b37c-269af3b7f71c	Medium 6.4	—	5.5.0 and earlier	`5.5.1`	September 12, 2023
CVE-2023-27429	Medium 4.4	0.4%	5.4.4 and earlier	`5.5.0`	March 5, 2023
WF-32f2fc21-165c-483f-ab81-48d8f221e4be	Medium 4.4	—	5.5.0 and earlier	`5.5.1`	September 12, 2023

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.