Jetpack - AI Agents & MCP, Security, Backup & Analytics
by Automattic · 3,000,000+ active installs · Checked 3 Nov 2026
Healthy8 Warnings
Healthy: vulnerability published 7 Oct 2026, fixed in 16.3.
84/ 100 Canary Score
| Ownership | 100 |
|---|---|
| Maintenance | 100 |
| Security | 60 |
| Support | 92 |
| Reputation | 70 |
Active signals
Facts we detected, with links to the source.
- WarningSEC-1Vulnerability published 7 Oct 2026, fixed in 16.3. Update to version 16.3 or later.7 Oct 2026Evidence
- WarningSEC-1Vulnerability published 7 Oct 2026, fixed in 16.3. Update to version 16.3 or later.7 Oct 2026Evidence
- WarningSEC-1Vulnerability published 8 Sep 2026, fixed in 16.1.3. Update to version 16.1.3 or later.8 Sep 2026Evidence
- WarningSEC-1Vulnerability published 5 Sep 2026, fixed in 16.1.3. Update to version 16.1.3 or later.5 Sep 2026Evidence
- WarningSEC-1Vulnerability published 5 Sep 2026, fixed in 16.1.3. Update to version 16.1.3 or later.5 Sep 2026Evidence
- WarningSEC-1Vulnerability published 3 Sep 2026, fixed in 14.5.1. Update to version 14.5.1 or later.3 Sep 2026Evidence
- WarningSEC-1Vulnerability published 3 Sep 2026, fixed in 12.0.3. Update to version 12.0.3 or later.3 Sep 2026Evidence
- WarningSEC-1Vulnerability published 3 Sep 2026, fixed in 16.1.3. Update to version 16.1.3 or later.3 Sep 2026Evidence
- InfoSEC-39 vulnerabilities published in the last 24 months. Review this plugin.4 Nov 2026Evidence
Ownership timeline
Who commits to the plugin's code on wordpress.org, over time.
| jeherve | 10 Jan 2019 to 14 Oct 2024, 569 commits |
|---|---|
| kraftbj | 6 Mar 2019 to 1 Sep 2026, 145 commits |
| zinigor | 27 Jun 2019 to 4 Mar 2025, 165 commits |
| dsmart | 2 Jul 2019 to 3 Mar 2020, 21 commits |
| mdbitz | 3 Mar 2020 to 3 Mar 2020, 2 commits |
| bjorsch | 25 Nov 2020 to 20 Aug 2026, 52 commits |
| samiff | 25 May 2021 to 12 Mar 2024, 227 commits |
| sdixon194 | 29 Jun 2021 to 10 Jan 2024, 142 commits |
| wpkaren | 6 Apr 2022 to 11 Jan 2023, 65 commits |
| bindlegirl | 4 May 2022 to 17 Apr 2023, 67 commits |
| ice9js | 25 Sep 2023 to 16 Dec 2024, 130 commits |
| bradshawtm | 20 May 2024 to 9 Apr 2026, 188 commits |
| gmjuhasz | 4 Aug 2025 to 9 Mar 2026, 55 commits |
| manzoorwani.jk | 19 Sep 2025 to 4 Feb 2026, 31 commits |
| veryhappytiger | 11 Nov 2025 to 7 Jan 2026, 16 commits |
| automattic | 13 Apr 2026 to 3 Nov 2026, 39 commits |
| robertsa8c | 19 May 2026 to 14 Jul 2026, 31 commits |
| Adnan007 | 20 Jul 2026 to 6 Oct 2026, 34 commits |
| chrisbliss18 | 25 Aug 2026 to 10 Sep 2026, 11 commits |
| jetpackisbestpack | 26 Oct 2026 to 3 Nov 2026, 9 commits |
| dlocc | 3 Nov 2026 to 3 Nov 2026, 1 commits |
New committer dlocc made a first commit on 3 Nov 2026. New committer jetpackisbestpack made a first commit on 26 Oct 2026. New committer chrisbliss18 made a first commit on 25 Aug 2026.
Maintenance
- Last release
- today
- Releases, 24 months
- 356
- Tested up to
- 7.1 current
- Requires PHP
- 7.4 supported 8.2+
| Q1 2024 | 36 |
|---|---|
| Q2 2024 | 26 |
| Q3 2024 | 20 |
| Q4 2024 | 122 |
| Q1 2025 | 143 |
| Q2 2025 | 21 |
| Q3 2025 | 26 |
| Q4 2025 | 25 |
| Q1 2026 | 19 |
| Q2 2026 | 21 |
| Q3 2026 | 65 |
| Q4 2026 | 22 |
Last release 3 Nov 2026. Tested with WordPress 7.1 (current).
Support
92% of 61 support threads resolved in the last 2 months.
Security record
| Published | Issue | CVSS | Affected | Fixed in | Days to patch |
|---|---|---|---|---|---|
| 7 Oct 2026 | Jetpack – WP Security, Backup, Speed, & Growth <= 16.2 - Missing Authorization | 5.3 | <= 16.2 | 16.3 | 0 |
| 7 Oct 2026 | Jetpack – WP Security, Backup, Speed, & Growth <= 16.2 - Missing Authorization | 5.3 | <= 16.2 | 16.3 | 0 |
| 8 Sep 2026 | Jetpack – WP Security, Backup, Speed, & Growth 16.1 - 16.1.2 - Unauthenticated Stored Cross-Site Scripting | 7.2 | 16.1 to 16.1.2 | 16.1.3 | 0 |
| 5 Sep 2026 | Jetpack – WP Security, Backup, Speed, & Growth 16.1 - 16.1.2 - Authenticated (Administrator+) PHP Object Injection | 6.6 | 16.1 to 16.1.2 | 16.1.3 | 0 |
| 5 Sep 2026 | Jetpack – WP Security, Backup, Speed, & Growth 16.1 - 16.1.2 - Authenticated (Administrator+) PHP Object Injection | 6.6 | 16.1 to 16.1.2 | 16.1.3 | 0 |
| 3 Sep 2026 | Jetpack 14.5 - 16.1.2 - Reflected to Stored Cross-Site Scripting via Reader Repost Parameters | 6.1 | 14.5, 14.6, 14.7, 14.8, 14.9 to 14.9.1, 15.0 to 15.0.2, 15.1 to 15.1.1, 15.2, 15.3 to 15.3.1, 15.4, 15.5, 15.6, 15.7 to 15.7.1, 15.8, 15.9 to 15.9.1, 16.0 to 16.0.1, 16.1 to 16.1.2 | 14.5.1 | 0 |
| 3 Sep 2026 | Jetpack 12.0 - 16.1.2 - Authenticated (Administrator+) PHP Object Injection | 7.2 | 12.0 to 12.0.2, 12.1 to 12.1.2, 12.2 to 12.2.2, 12.3 to 12.3.1, 12.4 to 12.4.1, 12.5 to 12.5.1, 12.6 to 12.6.3, 12.7 to 12.7.2, 12.8 to 12.8.2, 12.9 to 12.9.4, 13.0 to 13.0.1, 13.1 to 13.1.4, 13.2 to 13.2.3, 13.3 to 13.3.2, 13.4 to 13.4.4, 13.5 to 13.5.1, 13.6 to 13.6.1, 13.7 to 13.7.1, 13.8 to 13.8.2, 13.9 to 13.9.1, 14.0, 14.1, 14.2 to 14.2.1, 14.3, 14.4 to 14.4.1, 14.5, 14.6, 14.7, 14.8, 14.9 to 14.9.1, 15.0 to 15.0.2, 15.1 to 15.1.1, 15.2, 15.3 to 15.3.1, 15.4, 15.5, 15.6, 15.7 to 15.7.1, 15.8, 15.9 to 15.9.1, 16.0 to 16.0.1, 16.1 to 16.1.2 | 12.0.3 | 0 |
| 3 Sep 2026 | Jetpack 3.2 - 16.1.2 - Missing Authorization on WPCOM Media API Attachment Parent | 4.3 | 3.2 to 16.1.2 | 16.1.3 | 0 |
| 4 Dec 2024 | Jetpack 13.0 - 14.0 - Reflected DOM-based Cross-Site Scripting | 6.1 | 13.0 to 14.0 | 14.1 | 0 |
| 17 Oct 2024 | Jetpack <= 13.7 - Unauthenticated Arbitrary Block & Shortcode Execution | 6.5 | <= 13.7 | 13.8 | 0 |
| 17 Oct 2024 | Jetpack <= 13.7 & Jetpack Boost <= 3.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting | 6.4 | <= 13.7 | 13.8 | 0 |
| 14 Oct 2024 | Jetpack < 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure | 4.3 | 11.5 to 11.5.2, 10.0 to 10.0.1, 10.1 to 10.1.1, 10.2 to 10.2.2, 10.3 to 10.3.1, 10.4 to 10.4.1, 10.5 to 10.5.2, 10.6 to 10.6.1, 10.7 to 10.7.1, 10.8 to 10.8.1, 10.9 to 10.9.2, 11.0 to 11.0.1, 11.1 to 11.1.3, 11.2 to 11.2.1, 11.3 to 11.3.3, 11.4 to 11.4.1, 11.6 to 11.6.1, 11.7 to 11.7.2, 11.8 to 11.8.5, 11.9 to 11.9.2, 12.0 to 12.0.1, 12.1 to 12.1.1, 12.2 to 12.2.1, 12.3, 12.4, 12.5, 12.6 to 12.6.2, 12.7 to 12.7.1, 12.8 to 12.8.1, 12.9 to 12.9.3, 13.0, 13.1 to 13.1.3, 13.2 to 13.2.2, 13.3 to 13.3.1, 13.4 to 13.4.3, 13.5, 13.6, 13.7, 13.8 to 13.8.1, 13.9, 3.9 to 3.9.9, 4.0 to 4.0.6, 4.1 to 4.1.3, 4.2 to 4.2.4, 4.3 to 4.3.4, 4.4 to 4.4.4, 4.5 to 4.5.2, 4.6 to 4.6.2, 4.7 to 4.7.3, 4.8 to 4.8.4, 4.9 to 4.9.2, 5.0 to 5.0.2, 5.1 to 5.1.3, 5.2 to 5.2.4, 5.3 to 5.3.3, 5.4 to 5.4.3, 5.5 to 5.5.4, 5.6 to 5.6.4, 5.7 to 5.7.4, 5.8 to 5.8.3, 5.9 to 5.9.3, 6.0 to 6.0.3, 6.1 to 6.1.4, 6.2 to 6.2.4, 6.3 to 6.3.6, 6.4 to 6.4.5, 6.5 to 6.5.3, 6.6 to 6.6.4, 6.7 to 6.7.3, 6.8 to 6.8.4, 6.9 to 6.9.3, 7.0 to 7.0.4, 7.1 to 7.1.4, 7.2 to 7.2.4, 7.3 to 7.3.4, 7.4 to 7.4.4, 7.5 to 7.5.6, 7.6 to 7.6.3, 7.7 to 7.7.5, 7.8 to 7.8.3, 7.9 to 7.9.3, 8.0 to 8.0.2, 8.1 to 8.1.3, 8.2 to 8.2.5, 8.3 to 8.3.2, 8.4 to 8.4.4, 8.5 to 8.5.2, 8.6 to 8.6.3, 8.7 to 8.7.3, 8.8 to 8.8.4, 8.9 to 8.9.3, 9.0 to 9.0.4, 9.1 to 9.1.2, 9.2 to 9.2.3, 9.3 to 9.3.4, 9.4 to 9.4.3, 9.5 to 9.5.4, 9.6 to 9.6.3, 9.7 to 9.7.2, 9.8 to 9.8.2, 9.9 to 9.9.2 | 3.9.10 | 0 |
| 13 May 2024 | Jetpack – WP Security, Backup, Speed, & Growth <= 13.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpvideo Shortcode | 6.4 | <= 13.3.1 | 13.4 | 0 |
| 16 Nov 2023 | Jetpack <= 12.8-a.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via block attribute | 6.4 | <= 12.8-a.1 | 12.8-a.3 | 83 |
| 16 Nov 2023 | Jetpack <= 12.6.2 - Improper Authorization via WPCom External Media REST endpoints | 4.3 | < 12.7 | 12.7 | 0 |
| 16 Nov 2023 | Jetpack < 12.7 - Authenticated(Contributor+) Clickjacking via Iframe Injection | 5 | < 12.7 | 12.7 | 0 |
| 30 May 2023 | Jetpack <= 12.1 - Authenticated (Author+) Arbitrary File Manipulation | 6.5 | 7.2 to 7.2.3, 7.3 to 7.3.3, 7.4 to 7.4.3, 7.5 to 7.5.5, 7.6 to 7.6.2, 7.7 to 7.7.4, 7.8 to 7.8.2, 7.9 to 7.9.2, 8.0 to 8.0.1, 8.1 to 8.1.2, 8.2 to 8.2.4, 8.3 to 8.3.1, 8.4 to 8.4.3, 8.5 to 8.5.1, 8.6 to 8.6.2, 8.7 to 8.7.2, 8.8 to 8.8.3, 8.9 to 8.9.2, 9.0 to 9.0.3, 9.1 to 9.1.1, 9.2 to 9.2.2, 9.3 to 9.3.3, 9.4 to 9.4.2, 9.5 to 9.5.3, 9.6 to 9.6.2, 9.7 to 9.7.1, 9.8 to 9.8.1, 9.9 to 9.9.1, 10.0, 10.1, 10.2 to 10.2.1, 10.3, 10.4, 10.5 to 10.5.1, 10.6 to 10.6.1, 10.7, 10.8, 10.9 to 10.9.1, 11.0, 11.1 to 11.1.2, 11.2, 11.3 to 11.3.2, 11.4, 11.5 to 11.5.1, 11.6, 11.7 to 11.7.1, 11.8 to 11.8.4, 11.9 to 11.9.1, 12.0, 12.1, 2.0 to 2.0.8, 2.1 to 2.1.6, 2.2 to 2.2.9, 2.3 to 2.3.9, 2.4 to 2.4.6, 2.5 to 2.5.4, 2.6 to 2.6.5, 2.7 to 2.7.4, 2.8 to 2.8.4, 2.9 to 2.9.5, 3.0 to 3.0.5, 3.1 to 3.1.4, 3.2 to 3.2.4, 3.3 to 3.3.5, 3.4 to 3.4.5, 3.5 to 3.5.5, 3.6 to 3.6.3, 3.7 to 3.7.4, 3.8 to 3.8.4, 3.9 to 3.9.8, 4.0 to 4.0.5, 4.1 to 4.1.2, 4.2 to 4.2.3, 4.3 to 4.3.3, 4.4 to 4.4.3, 4.5 to 4.5.1, 4.6 to 4.6.1, 4.7 to 4.7.2, 4.8 to 4.8.3, 4.9 to 4.9.1, 5.0 to 5.0.1, 5.1 to 5.1.2, 5.2 to 5.2.3, 5.3 to 5.3.2, 5.4 to 5.4.2, 5.5 to 5.5.3, 5.6 to 5.6.3, 5.7 to 5.7.3, 5.8 to 5.8.2, 5.9 to 5.9.2, 6.0 to 6.0.2, 6.1 to 6.1.3, 6.2 to 6.2.3, 6.3 to 6.3.5, 6.4 to 6.4.4, 6.5 to 6.5.2, 6.6 to 6.6.3, 6.7 to 6.7.2, 6.8 to 6.8.3, 6.9 to 6.9.2, 7.0 to 7.0.3, 7.1 to 7.1.3 | 2.0.9 | 0 |
| 1 Jun 2021 | JetPack <= 9.7 - Information Disclosure | 5.3 | 2.0 to 2.0.8, 2.1 to 2.1.6, 2.2 to 2.2.9, 2.3 to 2.3.9, 2.4 to 2.4.6, 2.5 to 2.5.4, 2.6 to 2.6.5, 2.7 to 2.7.4, 2.8 to 2.8.4, 2.9 to 2.9.5, 3.0 to 3.0.5, 3.1 to 3.1.4, 3.2 to 3.2.4, 3.3 to 3.3.5, 3.4 to 3.4.5, 3.5 to 3.5.5, 3.6 to 3.6.3, 3.7 to 3.7.4, 3.8 to 3.8.4, 3.9 to 3.9.8, 4.0 to 4.0.5, 4.1 to 4.1.2, 4.2 to 4.2.3, 4.3 to 4.3.3, 4.4 to 4.4.3, 4.5 to 4.5.1, 4.6 to 4.6.1, 4.7 to 4.7.2, 4.8 to 4.8.3, 4.9 to 4.9.1, 5.0 to 5.0.1, 5.1 to 5.1.2, 5.2 to 5.2.3, 5.3 to 5.3.2, 5.4 to 5.4.2, 5.5 to 5.5.3, 5.6 to 5.6.3, 5.7 to 5.7.3, 5.8 to 5.8.2, 5.9 to 5.9.2, 6.0 to 6.0.2, 6.1 to 6.1.3, 6.2 to 6.2.3, 6.3 to 6.3.5, 6.4 to 6.4.4, 6.5 to 6.5.2, 6.6 to 6.6.3, 6.7 to 6.7.2, 6.8 to 6.8.3, 6.9 to 6.9.2, 7.0 to 7.0.3, 7.1 to 7.1.3, 7.2 to 7.2.3, 7.3 to 7.3.3, 7.4 to 7.4.3, 7.5 to 7.5.5, 7.6 to 7.6.2, 7.7 to 7.7.4, 7.8 to 7.8.2, 7.9 to 7.9.2, 8.0 to 8.0.1, 8.1 to 8.1.2, 8.2 to 8.2.4, 8.3 to 8.3.1, 8.4 to 8.4.3, 8.5 to 8.5.1, 8.6 to 8.6.2, 8.7 to 8.7.2, 8.8 to 8.8.3, 8.9 to 8.9.2, 9.0 to 9.0.3, 9.1 to 9.1.1, 9.2 to 9.2.2, 9.3 to 9.3.3, 9.4 to 9.4.2, 9.5 to 9.5.3, 9.6 to 9.6.2, 9.7 to 9.7.1 | 2.0.8 | 1400 |
| 19 Oct 2019 | Jetpack <= 7.9 - Stored Cross-Site Scripting | 6.4 | < 5.1, 5.1 to 5.1.1, 5.2 to 5.2.2, 5.3 to 5.3.1, 5.4 to 5.4.1, 5.5 to 5.5.2, 5.6 to 5.6.2, 5.7 to 5.7.2, 5.8 to 5.8.1, 5.9 to 5.9.1, 6.0 to 6.0.1, 6.1 to 6.1.2, 6.2 to 6.2.2, 6.3 to 6.3.4, 6.4 to 6.4.3, 6.5 to 6.5.1, 6.6 to 6.6.2, 6.7 to 6.7.1, 6.8 to 6.8.2, 6.9 to 6.9.1, 7.0 to 7.0.2, 7.1 to 7.1.2, 7.2 to 7.2.2, 7.3 to 7.3.2, 7.4 to 7.4.2, 7.5 to 7.5.4, 7.6 to 7.6.1, 7.7 to 7.7.3, 7.8 to 7.8.1, 7.9 to 7.9.1 | 5.1.1 | 1991 |
| 14 Feb 2019 | Jetpack < 7.0.1 - Cross-Site Scripting | 6.1 | <= 7.0 | 7.0.1 | 1 |
| 11 Dec 2018 | Jetpack <= 6.4.2 - Cross-Site Scripting via post_meta | 5.4 | <= 6.4.2 | 6.5 | n/a |
| 26 Apr 2017 | Jetpack – WP Security, Backup, Speed, & Growth < 4.2 - Timing Attack | 9.8 | < 4.2 | 4.2 | 2897 |
| 26 Apr 2017 | Jetpack – WP Security, Backup, Speed, & Growth < 4.2 - Reflected Cross-Site Scripting | 6.1 | < 4.2 | 4.2 | 2897 |
| 26 Apr 2017 | Jetpack – WP Security, Backup, Speed, & Growth < 4.2 - CSV Injection | 9.6 | < 4.2 | 4.2 | 2897 |
| 26 Apr 2017 | Jetpack <= 4.0.2 - Cross-Site Scripting | 6.1 | < 4.0.3 | 4.0.3 | n/a |
Source: Wordfence Intelligence.
Reputation
| Q2 2026 | 3.7 |
|---|---|
| Q3 2026 | 2.1 |
| Q4 2026 | 3.7 |
Average rating stayed at 3.7 between Q2 2026 and Q4 2026.
| 5 star | 1451 |
|---|---|
| 4 star | 173 |
| 3 star | 96 |
| 2 star | 104 |
| 1 star | 584 |
Latest low reviews
- Keeps getting worst and worst · 1 star · 30 Oct 2026
- Not Recommended at all. · 1 star · 9 Sep 2026
- Worst plugin, Not recommend! · 1 star · 24 Aug 2026
Momentum
3,000,000+ active installs. History builds with each weekly snapshot.
Weekly downloads, last 27 weeks
| 4 May 2026 | 995,977 |
|---|---|
| 11 May 2026 | 262,764 |
| 18 May 2026 | 288,274 |
| 25 May 2026 | 237,118 |
| 1 Jun 2026 | 140,775 |
| 8 Jun 2026 | 1,677,187 |
| 15 Jun 2026 | 231,506 |
| 22 Jun 2026 | 1,630,953 |
| 29 Jun 2026 | 276,159 |
| 6 Jul 2026 | 1,755,888 |
| 13 Jul 2026 | 1,811,195 |
| 20 Jul 2026 | 249,903 |
| 27 Jul 2026 | 185,005 |
| 3 Aug 2026 | 146,436 |
| 10 Aug 2026 | 3,142,863 |
| 17 Aug 2026 | 1,750,214 |
| 24 Aug 2026 | 358,184 |
| 31 Aug 2026 | 3,371,951 |
| 7 Sep 2026 | 1,842,473 |
| 14 Sep 2026 | 348,135 |
| 21 Sep 2026 | 213,685 |
| 28 Sep 2026 | 151,925 |
| 5 Oct 2026 | 1,718,289 |
| 12 Oct 2026 | 1,715,292 |
| 19 Oct 2026 | 287,054 |
| 26 Oct 2026 | 320,886 |
| 2 Nov 2026 | 26,169 |
Weekly downloads over the last 4 weeks are 37% below the 27-week average.
Healthier alternatives
Same category, higher Canary Score. Never sponsored.
Facts
| Version | 16.4 |
|---|---|
| Author | Automattic |
| Added | 20 Jan 2011 |
| Last updated | 3 Nov 2026 |
| Active installs | 3,000,000+ |
| Requires WordPress | 7.0 |
| Tested up to | 7.1.4 |
| Requires PHP | 7.4 |
| Category | Security & Privacy > Security Scanning & Malware Protection |
| Tags | AI, mcp, backup, security, migration |
Other plugins by this author: WooCommerce, Akismet Anti-spam: Spam Protection, WP Super Cache, WooCommerce Legacy REST API, Limit Login Attempts, Layout Grid Block, Jetpack Boost - Website Speed, Performance and Critical CSS, Crowdsignal Forms, Crowdsignal Dashboard - Polls, Surveys & more, Page Optimize, Jetpack Protect, Gravatar Enhanced - Avatars, Profiles, and Privacy
Questions
Is Jetpack - AI Agents & MCP, Security, Backup & Analytics still maintained?
Jetpack - AI Agents & MCP, Security, Backup & Analytics was last updated on 3 Nov 2026. Its Canary status is Healthy.
Is Jetpack - AI Agents & MCP, Security, Backup & Analytics safe?
Jetpack - AI Agents & MCP, Security, Backup & Analytics has no open unpatched vulnerabilities on record. 9 vulnerabilities were published in the last 24 months. Its Canary status is Healthy.
Who owns Jetpack - AI Agents & MCP, Security, Backup & Analytics?
The wordpress.org author is Automattic. Recent committers: automattic, jetpackisbestpack, dlocc, Adnan007, chrisbliss18. New committer dlocc made a first commit on 3 Nov 2026.
What can I use instead of Jetpack - AI Agents & MCP, Security, Backup & Analytics?
Plugins in the same category with a higher Canary Score: Catch Web Tools, WP Helper Premium, Foxtool All-in-One: Contact chat button, Custom login, Media optimize images, Nexter Extension - Security, Performance, Code Snippets & Site Toolkit.