目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

Automattic 厂商漏洞列表 / CVE 中文分析 75

Automattic 厂商相关 75 条 CVE 漏洞，含 AI 中文分析、POC、CVSS 评分与受影响产品。

Automattic 是 WordPress.com 的运营方及 WordPress 核心贡献者，主要提供博客托管与内容管理解决方案。其生态因广泛使用而成为攻击重灾区，历史漏洞多集中于远程代码执行、跨站脚本及权限绕过。尽管拥有完善的安全团队，但插件兼容性常引发风险。近期值得关注的是其持续强化自动化扫描机制，以应对日益复杂的供应链攻击，确保持续维护平台稳定性。

Top products by Automattic: WooCommerce mongoose Jetpack WooPayments – Fully Integrated Solution Built and Supported by Woo WP Job Manager Sensei LMS WordPress Newspack Blocks Jetpack – WP Security, Backup, Speed, & Growth Newspack Newsletters WP Job Manager - Resume Manager automattic/mongoose Developer Newspack Content Converter Crowdsignal Dashboard – Polls, Surveys & more Jetpack Debug Tools Jetpack VideoPress Crowdsignal Forms Jetpack CRM WP Super Cache Newspack GHActivity Newspack Ads Newspack Campaigns ChaosTheory Sensei LMS – Online Courses, Quizzes, & Learning WordPress.com Editing Toolkit Jetpack CRM – Clients, Leads, Invoices, Billing, Email Marketing, & Automation Limit Login Attempts
CVE ID 标题 CVSS 风险等级 Published
CVE-2026-125120 Mongoose 未对 countDocuments 应用 sanitizeFilter 漏洞 — mongoose CWE-943 9.8 Critical 2026-11-09
CVE-2026-125119 Mongoose 未应用连接级 sanitizeFilter 过滤漏洞 — mongoose CWE-943 7.5 High 2026-11-09
CVE-2026-125118 Mongoose 原型污染漏洞 — mongoose CWE-1321 6.5 Medium 2026-11-09
CVE-2026-125117 Mongoose 原型链污染导致拒绝服务漏洞 — mongoose CWE-1321 8.2 High 2026-11-09
CVE-2026-125116 Mongoose 远程代码执行漏洞 — mongoose CWE-843 4.8 Medium 2026-11-09
CVE-2026-112329 Sensei LMS 4.26.4 访问控制绕过漏洞 — Sensei LMS CWE-862 4.3 Medium 2026-10-19
CVE-2026-112328 Sensei LMS 4.26.4 通过 AJAX 的访问控制漏洞 — Sensei LMS CWE-862 4.3 Medium 2026-10-19
CVE-2026-40808 WordPress Jetpack VideoPress 3.6 之前版本访问控制缺陷漏洞 — Jetpack VideoPress CWE-862 6.5 Medium 2026-10-10
CVE-2026-106608 WordPress WooCommerce 9.8.0-11.1.2 提权漏洞 — WooCommerce CWE-266 7.2 High 2026-10-10
CVE-2026-106602 WordPress Jetpack <= 16.2 认证缺陷漏洞 — Jetpack CWE-288 4.8 Medium 2026-10-09
CVE-2026-106601 WordPress Jetpack插件 <= 16.2 认证错误漏洞 — Jetpack CWE-288 5.4 Medium 2026-10-09
CVE-2026-66666 WordPress <= 7.1.2 私有及未发布文章评论敏感数据泄露漏洞 — WordPress CWE-201 6.9 Medium 2026-10-06
CVE-2026-93485 WordPress 7.1 跨站脚本漏洞 — WordPress CWE-79 7.1 High 2026-09-18
CVE-2026-48888 WordPress WooCommerce 资源管理错误漏洞 — WooCommerce CWE-770 7.5 High 2026-09-08
CVE-2026-57777 WordPress WooCommerce SQL注入漏洞 — WooCommerce CWE-89 7.6 High 2026-09-04
CVE-2026-73562 Mongoose Schema路径getter原型污染漏洞 — mongoose CWE-1321 6.5 Medium 2026-08-13
CVE-2026-42334 Mongoose 注入漏洞 — mongoose CWE-74 7.5 High 2026-05-14
CVE-2026-3589 WordPress plugin WooCommerce 安全漏洞 — WooCommerce 8.8 - 2026-03-06
CVE-2026-22356 WordPress plugin Jetpack CRM 安全漏洞 — Jetpack CRM CWE-98 7.5 High 2026-02-20
CVE-2026-25404 WordPress plugin WP Job Manager 安全漏洞 — WP Job Manager CWE-862 5.3 Medium 2026-02-19
CVE-2023-54332 WordPress plugin Jetpack 跨站脚本漏洞 — Jetpack CWE-79 6.1 Medium 2026-01-13
CVE-2023-52212 WordPress plugin WP Job Manager 跨站请求伪造漏洞 — WP Job Manager CWE-352 5.4 Medium 2026-01-05
CVE-2025-69015 WordPress plugin Crowdsignal Forms 安全漏洞 — Crowdsignal Forms CWE-862 3.8 Low 2025-12-30
CVE-2025-15033 WordPress plugin WooCommerce 安全漏洞 — WooCommerce 4.3AI Medium AI 2025-12-22
CVE-2023-7320 WordPress plugin WooCommerce 信息泄露漏洞 — WooCommerce CWE-200 5.3 Medium 2025-10-29
CVE-2025-49042 WordPress plugin WooCommerce 跨站脚本漏洞 — WooCommerce CWE-79 5.9 Medium 2025-10-29
CVE-2025-57924 WordPress plugin Automattic Developer 跨站请求伪造漏洞 — Developer CWE-352 4.3 Medium 2025-09-22
CVE-2025-49325 WordPress plugin Newspack Newsletters 输入验证错误漏洞 — Newspack Newsletters CWE-601 4.7 Medium 2025-06-06
CVE-2025-5062 WordPress plugin WooCommerce 跨站脚本漏洞 — WooCommerce CWE-79 6.1 Medium 2025-05-22
CVE-2024-56006 WordPress plugin Jetpack Debug Tools 安全漏洞 — Jetpack Debug Tools CWE-862 5.3 Medium 2025-05-15

本页汇总了 Automattic 厂商截至目前公开的全部 75 条 CVE 漏洞。每条漏洞均包含 CVSS 评分、CWE 弱点分类、受影响产品与参考链接，并附带 AI 生成的中文分析以便快速判断风险。