Plugin security history

Jetpack – WP Security, Backup, Speed, & Growth Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 25 vulnerability records associated with Jetpack – WP Security, Backup, Speed, & Growth, published between 2014 and 2024.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

25Total records

2Critical

2High

21Medium

0Low

0Informational

25Patched records

0Currently marked unpatched

2014-08-26First disclosure

2024-12-04Latest disclosure

14 of 25CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2014	1	1 records
2015	4	4 records
2016	3	3 records
2017	4	4 records
2018	1	1 records
2019	2	2 records
2021	1	1 records
2023	4	4 records
2024	5	5 records

Severity Breakdown

Severity	Records	Share
Critical	2	8%
High	2	8%
Medium	21	84%

Vulnerability-Type Breakdown

Cross-Site Scripting

14 records56%

First: 2015. Latest: 2024.

Missing Authorization

4 records16%

First: 2014. Latest: 2024.

Other

4 records16%

First: 2017. Latest: 2023.

Information Disclosure

3 records12%

First: 2015. Latest: 2021.

Patch Status

Patched: 25
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

14.1
13.8
9.9.3
9.8.3
9.7.3
9.6.4
9.5.5
9.4.4
9.3.5
9.2.4
9.1.3
9.0.5
8.9.4
8.8.5
8.7.4
8.6.4
8.5.3
8.4.5
8.3.3
8.2.6
8.1.4
8.0.3
7.9.4
7.8.4
7.7.6
7.6.4
7.5.7
7.4.5
7.3.5
7.2.5
7.1.5
7.0.5
6.9.4
6.8.5
6.7.4
6.6.5
6.5.4
6.4.6
6.3.7
6.2.5
6.1.5
6.0.4
5.9.4
5.8.4
5.7.5
5.6.5
5.5.5
5.4.4
5.3.4
5.2.5

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-3.9.1`	Jetpack – WP Security, Backup, Speed, & Growth <= 3.9.1 - Sensitive Information Disclosure	February 25, 2016	3.9.2	Medium
`*-3.9.1`	Jetpack – WP Security, Backup, Speed, & Growth <= 3.9.1 - Cross-Site Scripting via LaTeX markup within HTML elements	February 25, 2016	3.9.2	Medium
`*-3.7.1`	Jetpack <= 3.7.1 - Stored Cross-Site Scripting	October 1, 2015	3.7.2	High
`*-3.7.1`	Jetpack <= 3.7.1 - Information disclosure	October 1, 2015	3.7.2	Medium
`*-3.5.2`	Jetpack <= 3.5.2 - Cross-Site Scripting	May 6, 2015	3.5.3	High
`[*, 3.4.3)`	Jetpack <= 3.4.2 - Reflected Cross-Site Scripting	April 20, 2015	3.4.3	Medium
`2.9-2.9.2`	Jetpack < 2.9.3 - Security Bypass	August 26, 2014	1.9.4, 2.0.9, 2.1.4, 2.2.7, 2.3.7, 2.4.4, 2.5.2, 2.6.3, 2.7.2, 2.8.2, 2.9.3	Medium
`2.8-2.8.1`	Jetpack < 2.9.3 - Security Bypass	August 26, 2014	1.9.4, 2.0.9, 2.1.4, 2.2.7, 2.3.7, 2.4.4, 2.5.2, 2.6.3, 2.7.2, 2.8.2, 2.9.3	Medium
`2.7-2.7.1`	Jetpack < 2.9.3 - Security Bypass	August 26, 2014	1.9.4, 2.0.9, 2.1.4, 2.2.7, 2.3.7, 2.4.4, 2.5.2, 2.6.3, 2.7.2, 2.8.2, 2.9.3	Medium
`2.6-2.6.2`	Jetpack < 2.9.3 - Security Bypass	August 26, 2014	1.9.4, 2.0.9, 2.1.4, 2.2.7, 2.3.7, 2.4.4, 2.5.2, 2.6.3, 2.7.2, 2.8.2, 2.9.3	Medium
`2.5-2.5.1`	Jetpack < 2.9.3 - Security Bypass	August 26, 2014	1.9.4, 2.0.9, 2.1.4, 2.2.7, 2.3.7, 2.4.4, 2.5.2, 2.6.3, 2.7.2, 2.8.2, 2.9.3	Medium
`2.4-2.4.3`	Jetpack < 2.9.3 - Security Bypass	August 26, 2014	1.9.4, 2.0.9, 2.1.4, 2.2.7, 2.3.7, 2.4.4, 2.5.2, 2.6.3, 2.7.2, 2.8.2, 2.9.3	Medium
`2.3-2.3.6`	Jetpack < 2.9.3 - Security Bypass	August 26, 2014	1.9.4, 2.0.9, 2.1.4, 2.2.7, 2.3.7, 2.4.4, 2.5.2, 2.6.3, 2.7.2, 2.8.2, 2.9.3	Medium
`2.2-2.2.6`	Jetpack < 2.9.3 - Security Bypass	August 26, 2014	1.9.4, 2.0.9, 2.1.4, 2.2.7, 2.3.7, 2.4.4, 2.5.2, 2.6.3, 2.7.2, 2.8.2, 2.9.3	Medium
`2.1-2.1.3`	Jetpack < 2.9.3 - Security Bypass	August 26, 2014	1.9.4, 2.0.9, 2.1.4, 2.2.7, 2.3.7, 2.4.4, 2.5.2, 2.6.3, 2.7.2, 2.8.2, 2.9.3	Medium
`2.0-2.0.8`	Jetpack < 2.9.3 - Security Bypass	August 26, 2014	1.9.4, 2.0.9, 2.1.4, 2.2.7, 2.3.7, 2.4.4, 2.5.2, 2.6.3, 2.7.2, 2.8.2, 2.9.3	Medium
`1.9-1.9.3`	Jetpack < 2.9.3 - Security Bypass	August 26, 2014	1.9.4, 2.0.9, 2.1.4, 2.2.7, 2.3.7, 2.4.4, 2.5.2, 2.6.3, 2.7.2, 2.8.2, 2.9.3	Medium
`*-1.8`	Jetpack < 2.9.3 - Security Bypass	August 26, 2014	1.9.4, 2.0.9, 2.1.4, 2.2.7, 2.3.7, 2.4.4, 2.5.2, 2.6.3, 2.7.2, 2.8.2, 2.9.3	Medium

Selected source records

Latest Records

MediumCVE-2024-10858

Jetpack 13.0 - 14.0 - Reflected DOM-based Cross-Site Scripting

Published: December 4, 2024

Affected versions: 13.0-14.0
Patched versions: 14.1

Original Wordfence record

MediumCVE-2024-10075

Jetpack <= 13.7 - Unauthenticated Arbitrary Block & Shortcode Execution

Published: October 17, 2024

Affected versions: *-13.7
Patched versions: 13.8

Original Wordfence record

MediumCVE-2024-10076

Jetpack <= 13.7 & Jetpack Boost <= 3.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: October 17, 2024

Affected versions: *-13.7
Patched versions: 13.8

Affected versions: *-3.4.7
Patched versions: 3.4.8

Original Wordfence record

MediumCVE-2024-9926

Jetpack < 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure

Published: October 14, 2024

Affected versions: 10.0-10.0.1; 10.1-10.1.1; 10.2-10.2.2; 10.3-10.3.1; 10.4-10.4.1; 10.5-10.5.2; 10.6-10.6.1; 10.7-10.7.1; 10.8-10.8.1; 10.9-10.9.2; 11.0-11.0.1; 11.1-11.1.3; 11.2-11.2.1; 11.3-11.3.3; 11.4-11.4.1; 11.5-11.5.2; 11.6-11.6.1; 11.7-11.7.2; 11.8-11.8.5; 11.9-11.9.2; 12.0-12.0.1; 12.1-12.1.1; 12.2-12.2.1; 12.3; 12.4; 12.5; 12.6-12.6.2; 12.7-12.7.1; 12.8-12.8.1; 12.9-12.9.3; 13.0; 13.1-13.1.3; 13.2-13.2.2; 13.3-13.3.1; 13.4-13.4.3; 13.5; 13.6; 13.7; 13.8-13.8.1; 13.9; 3.9-3.9.9; 4.0-4.0.6; 4.1-4.1.3; 4.2-4.2.4; 4.3-4.3.4; 4.4-4.4.4; 4.5-4.5.2; 4.6-4.6.2; 4.7-4.7.3; 4.8-4.8.4; 4.9-4.9.2; 5.0-5.0.2; 5.1-5.1.3; 5.2-5.2.4; 5.3-5.3.3; 5.4-5.4.3; 5.5-5.5.4; 5.6-5.6.4; 5.7-5.7.4; 5.8-5.8.3; 5.9-5.9.3; 6.0-6.0.3; 6.1-6.1.4; 6.2-6.2.4; 6.3-6.3.6; 6.4-6.4.5; 6.5-6.5.3; 6.6-6.6.4; 6.7-6.7.3; 6.8-6.8.4; 6.9-6.9.3; 7.0-7.0.4; 7.1-7.1.4; 7.2-7.2.4; 7.3-7.3.4; 7.4-7.4.4; 7.5-7.5.6; 7.6-7.6.3; 7.7-7.7.5; 7.8-7.8.3; 7.9-7.9.3; 8.0-8.0.2; 8.1-8.1.3; 8.2-8.2.5; 8.3-8.3.2; 8.4-8.4.4; 8.5-8.5.2; 8.6-8.6.3; 8.7-8.7.3; 8.8-8.8.4; 8.9-8.9.3; 9.0-9.0.4; 9.1-9.1.2; 9.2-9.2.3; 9.3-9.3.4; 9.4-9.4.3; 9.5-9.5.4; 9.6-9.6.3; 9.7-9.7.2; 9.8-9.8.2; 9.9-9.9.2
Patched versions: 10.0.2, 10.1.2, 10.2.3, 10.3.2, 10.4.2, 10.5.3, 10.6.2, 10.7.2, 10.8.2, 10.9.3, 11.0.2, 11.1.4, 11.2.2, 11.3.4, 11.4.2, 11.5.3, 11.6.2, 11.7.3, 11.8.6, 11.9.3, 12.0.2, 12.1.2, 12.2.2, 12.3.1, 12.4.1, 12.5.1, 12.6.3, 12.7.2, 12.8.2, 12.9.4, 13.0.1, 13.1.4, 13.2.3, 13.3.2, 13.4.4, 13.5.1, 13.6.1, 13.7.1, 13.8.2, 13.9.1, 3.9.10, 4.0.7, 4.1.4, 4.2.5, 4.3.5, 4.4.5, 4.5.3, 4.6.3, 4.7.4, 4.8.5, 4.9.3, 5.0.3, 5.1.4, 5.2.5, 5.3.4, 5.4.4, 5.5.5, 5.6.5, 5.7.5, 5.8.4, 5.9.4, 6.0.4, 6.1.5, 6.2.5, 6.3.7, 6.4.6, 6.5.4, 6.6.5, 6.7.4, 6.8.5, 6.9.4, 7.0.5, 7.1.5, 7.2.5, 7.3.5, 7.4.5, 7.5.7, 7.6.4, 7.7.6, 7.8.4, 7.9.4, 8.0.3, 8.1.4, 8.2.6, 8.3.3, 8.4.5, 8.5.3, 8.6.4, 8.7.4, 8.8.5, 8.9.4, 9.0.5, 9.1.3, 9.2.4, 9.3.5, 9.4.4, 9.5.5, 9.6.4, 9.7.3, 9.8.3, 9.9.3

Original Wordfence record

MediumCVE-2024-4392

Jetpack – WP Security, Backup, Speed, & Growth <= 13.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpvideo Shortcode

Published: May 13, 2024

Affected versions: *-13.3.1
Patched versions: 13.4

Original Wordfence record

MediumCVE-2023-45050

Jetpack <= 12.8-a.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via block attribute

Published: November 16, 2023

Affected versions: * - 12.8-a.1
Patched versions: 12.8-a.3

Original Wordfence record

MediumCVE-2023-47774

Jetpack < 12.7 - Authenticated(Contributor+) Clickjacking via Iframe Injection

Published: November 16, 2023

Affected versions: [*, 12.7)
Patched versions: 12.7

Original Wordfence record

MediumCVE-2023-47788

Jetpack <= 12.6.2 - Improper Authorization via WPCom External Media REST endpoints

Published: November 16, 2023

Affected versions: [*, 12.7)
Patched versions: 12.7

Original Wordfence record

Highest-Severity Records

Critical

Jetpack – WP Security, Backup, Speed, & Growth < 4.2 - Timing Attack

Published: April 26, 2017

Affected versions: [*, 4.2)
Patched versions: 4.2

Original Wordfence record

Critical

Jetpack – WP Security, Backup, Speed, & Growth < 4.2 - CSV Injection

Published: April 26, 2017

Affected versions: [*, 4.2)
Patched versions: 4.2

Original Wordfence record

High

Jetpack <= 3.7.1 - Stored Cross-Site Scripting

Published: October 1, 2015

Affected versions: *-3.7.1
Patched versions: 3.7.2

Original Wordfence record

High

Jetpack <= 3.5.2 - Cross-Site Scripting

Published: May 6, 2015

Affected versions: *-3.5.2
Patched versions: 3.5.3

Original Wordfence record

MediumCVE-2024-10075

Jetpack <= 13.7 - Unauthenticated Arbitrary Block & Shortcode Execution

Published: October 17, 2024

Affected versions: *-13.7
Patched versions: 13.8

Original Wordfence record

MediumCVE-2023-2996

Jetpack <= 12.1 - Authenticated (Author+) Arbitrary File Manipulation

Published: May 30, 2023

Affected versions: 10.0; 10.1; 10.2-10.2.1; 10.3; 10.4; 10.5-10.5.1; 10.6-10.6.1; 10.7; 10.8; 10.9-10.9.1; 11.0; 11.1-11.1.2; 11.2; 11.3-11.3.2; 11.4; 11.5-11.5.1; 11.6; 11.7-11.7.1; 11.8-11.8.4; 11.9-11.9.1; 12.0; 12.1; 2.0-2.0.8; 2.1-2.1.6; 2.2-2.2.9; 2.3-2.3.9; 2.4-2.4.6; 2.5-2.5.4; 2.6-2.6.5; 2.7-2.7.4; 2.8-2.8.4; 2.9-2.9.5; 3.0-3.0.5; 3.1-3.1.4; 3.2-3.2.4; 3.3-3.3.5; 3.4-3.4.5; 3.5-3.5.5; 3.6-3.6.3; 3.7-3.7.4; 3.8-3.8.4; 3.9-3.9.8; 4.0-4.0.5; 4.1-4.1.2; 4.2-4.2.3; 4.3-4.3.3; 4.4-4.4.3; 4.5-4.5.1; 4.6-4.6.1; 4.7-4.7.2; 4.8-4.8.3; 4.9-4.9.1; 5.0-5.0.1; 5.1-5.1.2; 5.2-5.2.3; 5.3-5.3.2; 5.4-5.4.2; 5.5-5.5.3; 5.6-5.6.3; 5.7-5.7.3; 5.8-5.8.2; 5.9-5.9.2; 6.0-6.0.2; 6.1-6.1.3; 6.2-6.2.3; 6.3-6.3.5; 6.4-6.4.4; 6.5-6.5.2; 6.6-6.6.3; 6.7-6.7.2; 6.8-6.8.3; 6.9-6.9.2; 7.0-7.0.3; 7.1-7.1.3; 7.2-7.2.3; 7.3-7.3.3; 7.4-7.4.3; 7.5-7.5.5; 7.6-7.6.2; 7.7-7.7.4; 7.8-7.8.2; 7.9-7.9.2; 8.0-8.0.1; 8.1-8.1.2; 8.2-8.2.4; 8.3-8.3.1; 8.4-8.4.3; 8.5-8.5.1; 8.6-8.6.2; 8.7-8.7.2; 8.8-8.8.3; 8.9-8.9.2; 9.0-9.0.3; 9.1-9.1.1; 9.2-9.2.2; 9.3-9.3.3; 9.4-9.4.2; 9.5-9.5.3; 9.6-9.6.2; 9.7-9.7.1; 9.8-9.8.1; 9.9-9.9.1
Patched versions: 10.0.1, 10.1.1, 10.2.2, 10.3.1, 10.4.1, 10.5.2, 10.6.2, 10.7.1, 10.8.1, 10.9.2, 11.0.1, 11.1.3, 11.2.1, 11.3.3, 11.4.1, 11.5.2, 11.6.1, 11.7.2, 11.8.5, 11.9.2, 12.0.1, 12.1.1, 2.0.9, 2.1.7, 2.2.10, 2.3.10, 2.4.7, 2.5.5, 2.6.6, 2.7.5, 2.8.5, 2.9.6, 3.0.6, 3.1.5, 3.2.5, 3.3.6, 3.4.6, 3.5.6, 3.6.4, 3.7.5, 3.8.5, 3.9.9, 4.0.6, 4.1.3, 4.2.4, 4.3.4, 4.4.4, 4.5.2, 4.6.2, 4.7.3, 4.8.4, 4.9.2, 5.0.2, 5.1.3, 5.2.4, 5.3.3, 5.4.3, 5.5.4, 5.6.4, 5.7.4, 5.8.3, 5.9.3, 6.0.3, 6.1.4, 6.2.4, 6.3.6, 6.4.5, 6.5.3, 6.6.4, 6.7.3, 6.8.4, 6.9.3, 7.0.4, 7.1.4, 7.2.4, 7.3.4, 7.4.4, 7.5.6, 7.6.3, 7.7.5, 7.8.3, 7.9.3, 8.0.2, 8.1.3, 8.2.5, 8.3.2, 8.4.4, 8.5.2, 8.6.3, 8.7.3, 8.8.4, 8.9.3, 9.0.4, 9.1.2, 9.2.3, 9.3.4, 9.4.3, 9.5.4, 9.6.3, 9.7.2, 9.8.2, 9.9.2

Original Wordfence record

MediumCVE-2024-4392

Jetpack – WP Security, Backup, Speed, & Growth <= 13.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpvideo Shortcode

Published: May 13, 2024

Affected versions: *-13.3.1
Patched versions: 13.4

Original Wordfence record

Medium

Jetpack <= 7.9 - Stored Cross-Site Scripting

Published: October 19, 2019

Affected versions: [*, 5.1); [5.1, 5.1.1); [5.2, 5.2.2); [5.3, 5.3.1); [5.4, 5.4.1); [5.5, 5.5.2); [5.6, 5.6.2); [5.7, 5.7.2); [5.8, 5.8.1); [5.9, 5.9.1); [6.0, 6.0.1); [6.1, 6.1.2); [6.2, 6.2.2); [6.3, 6.3.4); [6.4, 6.4.3); [6.5, 6.5.1); [6.6, 6.6.2); [6.7, 6.7.1); [6.8, 6.8.2); [6.9, 6.9.1); [7.0, 7.0.2); [7.1, 7.1.2); [7.2, 7.2.2); [7.3, 7.3.2); [7.4, 7.4.2); [7.5, 7.5.4); [7.6, 7.6.1); [7.7, 7.7.3); [7.8, 7.8.1); [7.9, 7.9.1)
Patched versions: 5.1.1, 5.2.2, 5.3.1, 5.4.1, 5.5.2, 5.6.2, 5.7.2, 5.8.1, 5.9.1, 6.0.1, 6.1.2, 6.2.2, 6.3.4, 6.4.3, 6.5.1, 6.6.2, 6.7.1, 6.8.2, 6.9.1, 7.0.2, 7.1.2, 7.2.2, 7.3.2, 7.4.2, 7.5.4, 7.6.1, 7.7.3, 7.8.1, 7.9.1

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory