Plugin security history

Jetpack CRM – Clients, Leads, Invoices, Billing, Email Marketing, & Automation Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 8 vulnerability records associated with Jetpack CRM – Clients, Leads, Invoices, Billing, Email Marketing, & Automation, published between 2022 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

8Total records

0Critical

2High

6Medium

0Low

0Informational

8Patched records

0Currently marked unpatched

2022-11-21First disclosure

2026-02-16Latest disclosure

5 of 8CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2022	2	2 records
2023	4	4 records
2024	1	1 records
2026	1	1 records

Severity Breakdown

Severity	Records	Share
High	2	25%
Medium	6	75%

Vulnerability-Type Breakdown

Cross-Site Scripting

4 records50%

First: 2022. Latest: 2023.

SQL Injection

1 record12.5%

First: 2022. Latest: 2022.

CSRF

1 record12.5%

First: 2023. Latest: 2023.

Information Disclosure

1 record12.5%

First: 2024. Latest: 2024.

Other

1 record12.5%

First: 2026. Latest: 2026.

Patch Status

Patched: 8
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

6.7.1
4.2.4
5.5.1
5.4.0
5.5.0
5.5
5.4.3

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-6.7.0`	Jetpack CRM <= 6.7.0 - Unauthenticated Local File Inclusion	February 16, 2026	6.7.1	High
`[*, 4.2.4)`	Jetpackcrm Ext Woo Connect < 2.13 - Sensitive Information Exposure	October 28, 2024	4.2.4	Medium
`*-5.5.0`	Jetpack CRM <= 5.5.0 - Authenticated (Client+) Stored Cross-Site Scripting	September 12, 2023	5.5.1	Medium
`*-5.5.0`	Jetpack CRM <= 5.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting	September 12, 2023	5.5.1	Medium
`*-5.3.1`	Jetpack CRM <= 5.3.1 - Cross-Site Request Forgery and PHAR Deserialization	April 18, 2023	5.4.0	High
`*-5.4.4`	Jetpack CRM <= 5.4.4 - Authenticated (Administrator+) Stored Cross-Site Scripting	March 5, 2023	5.5.0	Medium
`*-5.4.4`	Jetpack CRM <= 5.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting	December 19, 2022	5.5	Medium
`*-5.4.2`	Jetpack CRM <= 5.4.2 - Authenticated (Administrator+) Cross-Site Scripting	November 21, 2022	5.4.3	Medium

Selected source records

Latest Records

HighCVE-2026-22356

Jetpack CRM <= 6.7.0 - Unauthenticated Local File Inclusion

Published: February 16, 2026

Affected versions: *-6.7.0
Patched versions: 6.7.1

Original Wordfence record

Medium

Jetpackcrm Ext Woo Connect < 2.13 - Sensitive Information Exposure

Published: October 28, 2024

Affected versions: [*, 2.13)
Patched versions: 2.13

Affected versions: [*, 4.2.4)
Patched versions: 4.2.4

Original Wordfence record

Medium

Jetpack CRM <= 5.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting

Published: September 12, 2023

Affected versions: *-5.5.0
Patched versions: 5.5.1

Original Wordfence record

Medium

Jetpack CRM <= 5.5.0 - Authenticated (Client+) Stored Cross-Site Scripting

Published: September 12, 2023

Affected versions: *-5.5.0
Patched versions: 5.5.1

Original Wordfence record

HighCVE-2022-3342

Jetpack CRM <= 5.3.1 - Cross-Site Request Forgery and PHAR Deserialization

Published: April 18, 2023

Affected versions: *-5.3.1
Patched versions: 5.4.0

Original Wordfence record

MediumCVE-2023-27429

Jetpack CRM <= 5.4.4 - Authenticated (Administrator+) Stored Cross-Site Scripting

Published: March 5, 2023

Affected versions: *-5.4.4
Patched versions: 5.5.0

Original Wordfence record

MediumCVE-2022-4497

Jetpack CRM <= 5.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: December 19, 2022

Affected versions: *-5.4.4
Patched versions: 5.5

Original Wordfence record

MediumCVE-2022-3919

Jetpack CRM <= 5.4.2 - Authenticated (Administrator+) Cross-Site Scripting

Published: November 21, 2022

Affected versions: *-5.4.2
Patched versions: 5.4.3

Original Wordfence record

Highest-Severity Records

HighCVE-2026-22356

Jetpack CRM <= 6.7.0 - Unauthenticated Local File Inclusion

Published: February 16, 2026

Affected versions: *-6.7.0
Patched versions: 6.7.1

Original Wordfence record

HighCVE-2022-3342

Jetpack CRM <= 5.3.1 - Cross-Site Request Forgery and PHAR Deserialization

Published: April 18, 2023

Affected versions: *-5.3.1
Patched versions: 5.4.0

Original Wordfence record

Medium

Jetpack CRM <= 5.5.0 - Authenticated (Client+) Stored Cross-Site Scripting

Published: September 12, 2023

Affected versions: *-5.5.0
Patched versions: 5.5.1

Original Wordfence record

MediumCVE-2022-4497

Jetpack CRM <= 5.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: December 19, 2022

Affected versions: *-5.4.4
Patched versions: 5.5

Original Wordfence record

MediumCVE-2022-3919

Jetpack CRM <= 5.4.2 - Authenticated (Administrator+) Cross-Site Scripting

Published: November 21, 2022

Affected versions: *-5.4.2
Patched versions: 5.4.3

Original Wordfence record

Medium

Jetpackcrm Ext Woo Connect < 2.13 - Sensitive Information Exposure

Published: October 28, 2024

Affected versions: [*, 2.13)
Patched versions: 2.13

Affected versions: [*, 4.2.4)
Patched versions: 4.2.4

Original Wordfence record

MediumCVE-2023-27429

Jetpack CRM <= 5.4.4 - Authenticated (Administrator+) Stored Cross-Site Scripting

Published: March 5, 2023

Affected versions: *-5.4.4
Patched versions: 5.5.0

Original Wordfence record

Medium

Jetpack CRM <= 5.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting

Published: September 12, 2023

Affected versions: *-5.5.0
Patched versions: 5.5.1

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory