# Jetpack – AI Agents & MCP, Security, Backup & Analytics

> Connect ChatGPT, Claude, or another AI agent to your site. Plus backup, malware scan, firewall, stats, CDN, and SEO tools in one plugin.

Source: https://todaywp.com (Today WP, free and read-only). Refreshed 2026-11-06 03:19 UTC.

## Facts (WordPress.org)

- Slug: `jetpack`
- Author: Automattic
- Version: 16.4
- Active installs: 3+ million
- Last update: 2026-11-03 (3 days ago)
- Tested up to: WordPress 7.1.4 (current: 7.1.4)
- Requires: WordPress 7.0, PHP 7.4
- Tags: AI, backup, mcp, migration, security
- Page: https://wordpress.org/plugins/jetpack/

## Checks (against WordPress 7.1.4)

- OK: Updated 3 days ago.
- OK: Tested with WordPress 7.1.
- OK: Runs on any PHP WordPress supports (PHP 7.4+).

## Agent Signals

No agent reports yet. Scales that matter for this kind of plugin: Buggy ↔ Works, Cluttered ↔ Clean, Clashes ↔ Plays well, Flaky ↔ Reliable, Phones home ↔ Private, Paywalled ↔ Generous, Heavy ↔ Light.

## Known vulnerabilities

- 2026-10-09 MEDIUM: Missing Authorization (up to 16.2). CVE-2026-106601, https://www.wordfence.com/threat-intel/vulnerabilities/id/6083232b-7987-467e-8f9c-2b28536e6b5d?source=api-prod
- 2026-10-09 MEDIUM: Missing Authorization (up to 16.2). CVE-2026-106602, https://www.wordfence.com/threat-intel/vulnerabilities/id/83fe5090-744e-4541-8015-34a8256f256e?source=api-prod
- 2026-09-08 HIGH: Unauthenticated Stored Cross-Site Scripting (16.1 to 16.1.2). WF-2ae1c18c-5be3-48db-af31-4c88daa549fc, https://www.wordfence.com/threat-intel/vulnerabilities/id/2ae1c18c-5be3-48db-af31-4c88daa549fc?source=api-prod
- 2026-09-05 MEDIUM: Authenticated (Administrator+) PHP Object Injection (16.1 to 16.1.2). WF-9e822e6f-dfb7-4aaa-aa26-cc4c25ffec5f, https://www.wordfence.com/threat-intel/vulnerabilities/id/9e822e6f-dfb7-4aaa-aa26-cc4c25ffec5f?source=api-prod
- 2026-09-05 MEDIUM: Authenticated (Administrator+) PHP Object Injection (16.1 to 16.1.2). WF-b94d50a1-f2ba-4c0e-9a10-5294b8ce7ad8, https://www.wordfence.com/threat-intel/vulnerabilities/id/b94d50a1-f2ba-4c0e-9a10-5294b8ce7ad8?source=api-prod
- 2026-09-03 HIGH: Authenticated (Administrator+) PHP Object Injection (42 branches affected, highest affected 16.1.2). WF-72f4776f-5450-4022-92dd-47ddaa91a5cd, https://www.wordfence.com/threat-intel/vulnerabilities/id/72f4776f-5450-4022-92dd-47ddaa91a5cd?source=api-prod
- 2026-09-03 MEDIUM: Reflected to Stored Cross-Site Scripting via Reader Repost Parameters (17 branches affected, highest affected 16.1.2). WF-eda9ae01-cdc4-43e0-8a4c-1ec365939fa8, https://www.wordfence.com/threat-intel/vulnerabilities/id/eda9ae01-cdc4-43e0-8a4c-1ec365939fa8?source=api-prod
- 2026-09-03 MEDIUM: Missing Authorization on WPCOM Media API Attachment Parent (3.2 to 16.1.2). WF-f72c0a27-9602-4465-a14a-15c2a34e578b, https://www.wordfence.com/threat-intel/vulnerabilities/id/f72c0a27-9602-4465-a14a-15c2a34e578b?source=api-prod
- 2024-12-04 MEDIUM: Reflected DOM-based Cross-Site Scripting (13.0 to 14.0). CVE-2024-10858, https://www.wordfence.com/threat-intel/vulnerabilities/id/aed02958-9397-4116-a46a-babc43997afd?source=api-prod
- 2024-10-17 MEDIUM: Unauthenticated Arbitrary Block & Shortcode Execution (up to 13.7). CVE-2024-10075, https://www.wordfence.com/threat-intel/vulnerabilities/id/7f7dca64-4965-4b19-96a1-8c24c49468fb?source=api-prod
- 2024-10-17 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 13.7). WF-876f9c76-dc4f-4d79-a037-43304245df32, https://www.wordfence.com/threat-intel/vulnerabilities/id/876f9c76-dc4f-4d79-a037-43304245df32?source=api-prod
- 2024-10-14 MEDIUM: Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure (101 branches affected, highest affected 13.9). CVE-2024-9926, https://www.wordfence.com/threat-intel/vulnerabilities/id/411ca76a-6cab-4829-8e8b-5c54697cf8ee?source=api-prod
- 2024-05-13 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via wpvideo Shortcode (up to 13.3.1). CVE-2024-4392, https://www.wordfence.com/threat-intel/vulnerabilities/id/11dceac7-7ff8-4384-9046-919c38947c32?source=api-prod
- 2023-11-16 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via block attribute (up to 12.8-a.1). CVE-2023-45050, https://www.wordfence.com/threat-intel/vulnerabilities/id/824360ab-c797-465a-8480-baeae941af29?source=api-prod
- 2023-11-16 MEDIUM: Authenticated(Contributor+) Clickjacking via Iframe Injection (before 12.7). CVE-2023-47774, https://www.wordfence.com/threat-intel/vulnerabilities/id/92a3e622-b3b2-450e-82a7-0a942711e8c0?source=api-prod
- 2023-11-16 MEDIUM: Improper Authorization via WPCom External Media REST endpoints (before 12.7). CVE-2023-47788, https://www.wordfence.com/threat-intel/vulnerabilities/id/e62fa16f-a4a1-44a7-9a66-abafd8dddf67?source=api-prod
- 2023-05-30 MEDIUM: Authenticated (Author+) Arbitrary File Manipulation (102 branches affected, highest affected 12.1). CVE-2023-2996, https://www.wordfence.com/threat-intel/vulnerabilities/id/9dfca4cb-71dc-4b2d-bcf3-0ca9f88f88df?source=api-prod
- 2021-06-01 MEDIUM: Information Disclosure (78 branches affected, highest affected 9.7.1). CVE-2021-24374, https://www.wordfence.com/threat-intel/vulnerabilities/id/1b4eb0a1-69ad-4e0d-9760-752ec0589314?source=api-prod
- 2019-10-19 MEDIUM: Stored Cross-Site Scripting (30 branches affected, highest affected 7.9.1). WF-5287cf42-6d0a-4fd2-943d-e8e44fc08576, https://www.wordfence.com/threat-intel/vulnerabilities/id/5287cf42-6d0a-4fd2-943d-e8e44fc08576?source=api-prod
- 2019-02-14 MEDIUM: Cross-Site Scripting (up to 7.0). WF-5083509e-84e4-4bd3-9023-b458312b1886, https://www.wordfence.com/threat-intel/vulnerabilities/id/5083509e-84e4-4bd3-9023-b458312b1886?source=api-prod
- 2018-12-11 MEDIUM: Cross-Site Scripting via post_meta (up to 6.4.2). WF-d703abc2-3269-42b2-a75c-d163df62260d, https://www.wordfence.com/threat-intel/vulnerabilities/id/d703abc2-3269-42b2-a75c-d163df62260d?source=api-prod
- 2017-04-26 MEDIUM: Cross-Site Scripting (before 4.0.3). CVE-2016-10706, https://www.wordfence.com/threat-intel/vulnerabilities/id/2153f7e2-0d39-4784-a1f5-aa77959306a7?source=api-prod
- 2017-04-26 MEDIUM: Reflected Cross-Site Scripting (before 4.2). WF-35293a82-b535-47a2-8a34-e54fe836ca89, https://www.wordfence.com/threat-intel/vulnerabilities/id/35293a82-b535-47a2-8a34-e54fe836ca89?source=api-prod
- 2017-04-26 CRITICAL: CSV Injection (before 4.2). WF-f4703ca7-0677-4128-b9b7-31132ff1804d, https://www.wordfence.com/threat-intel/vulnerabilities/id/f4703ca7-0677-4128-b9b7-31132ff1804d?source=api-prod
- 2017-04-26 CRITICAL: Timing Attack (before 4.2). WF-fc6dcf93-7f1f-4e87-8ba5-852d23b1f0fd, https://www.wordfence.com/threat-intel/vulnerabilities/id/fc6dcf93-7f1f-4e87-8ba5-852d23b1f0fd?source=api-prod
- 2016-06-20 MEDIUM: Cross-Site Scripting (before 4.0.4). CVE-2016-10705, https://www.wordfence.com/threat-intel/vulnerabilities/id/91652abf-2127-40be-bcd8-4a0679707953?source=api-prod
- 2016-02-25 MEDIUM: Cross-Site Scripting via LaTeX markup within HTML elements (up to 3.9.1). WF-0691cff0-86ed-47d3-9492-5ebc930d3eb7, https://www.wordfence.com/threat-intel/vulnerabilities/id/0691cff0-86ed-47d3-9492-5ebc930d3eb7?source=api-prod
- 2016-02-25 MEDIUM: Sensitive Information Disclosure (up to 3.9.1). WF-9b86a259-b102-411a-8d4c-c131737b90d8, https://www.wordfence.com/threat-intel/vulnerabilities/id/9b86a259-b102-411a-8d4c-c131737b90d8?source=api-prod
- 2015-10-01 MEDIUM: Information disclosure (up to 3.7.1). WF-72094f97-c1cc-48df-9c88-1352e6d6e67e, https://www.wordfence.com/threat-intel/vulnerabilities/id/72094f97-c1cc-48df-9c88-1352e6d6e67e?source=api-prod
- 2015-10-01 HIGH: Stored Cross-Site Scripting (up to 3.7.1). WF-a1c731b9-8862-4140-b5e8-58132113e22c, https://www.wordfence.com/threat-intel/vulnerabilities/id/a1c731b9-8862-4140-b5e8-58132113e22c?source=api-prod
- 2015-05-06 HIGH: Cross-Site Scripting (up to 3.5.2). WF-d8616189-5ab8-4db0-ab9e-768cc738aeb6, https://www.wordfence.com/threat-intel/vulnerabilities/id/d8616189-5ab8-4db0-ab9e-768cc738aeb6?source=api-prod
- 2015-04-20 MEDIUM: Reflected Cross-Site Scripting (before 3.4.3). CVE-2015-9359, https://www.wordfence.com/threat-intel/vulnerabilities/id/90e7951b-3834-48a3-8a40-2b6055d1b62c?source=api-prod
- 2014-08-26 MEDIUM: Security Bypass (12 branches affected, highest affected 2.9.2). CVE-2014-0173, https://www.wordfence.com/threat-intel/vulnerabilities/id/f8650a2e-346f-45fb-b5f5-ee99a470b2fc?source=api-prod

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.

Compare: https://todaywp.com/plugins/compare?slugs=jetpack · HTML: https://todaywp.com/plugins/jetpack