Jetpack – WP Security, Backup, Speed, & Growth

92 Quality Score

Active Installs

29/30

With 3,000,000 active installs it is one of the most widely deployed plugins in the WordPress ecosystem, which heavily boosts its popularity score.

Update Freshness

25/25

A last update timestamp of July 2026 and full compatibility with WordPress 7.0 show that it is actively maintained by a large team with reliable release cadence.

User Rating

11/15

A 76 out of 100 from 2,400 reviews is a solid but not outstanding score; common complaints in the reviews focus on required WordPress.com connection and aggressive upgrade prompts.

Support Health

12/15

52 of 61 support threads resolved works out to 85.2%, which is healthy and consistent with a commercial plugin backed by a dedicated support team.

WP Compatibility

15/15

Tested up to WordPress 7.0 and requiring WordPress 6.9 and PHP 7.2, Jetpack runs on essentially every modern WordPress installation with no compatibility concerns.

Scores higher than 99% of indexed plugins

About

Improve your WP security with powerful one-click tools like backup, WAF, and malware scan. Includes free tools like stats, CDN and social sharing.

Active Installs 3M+

Rating ★★★½ 3.7/5

Last Updated 2026-09-10 4:31pm GMT

Requires WordPress 7.0+

Tested Up To 7.1

Requires PHP 7.4+

Security History

31 known vulnerabilities, all patched

2 Critical 4 High 25 Medium

Most recent: September 8, 2026

View details ▸

Jetpack – WP Security, Backup, Speed, & Growth 16.1 - 16.1.2 - Unauthenticated Stored Cross-Site Scripting High

September 8, 2026 Patched in ["16.1.3"]

Jetpack – WP Security, Backup, Speed, & Growth 16.1 - 16.1.2 - Authenticated (Administrator+) PHP Object Injection Medium

September 5, 2026 Patched in ["16.1.3"]

Jetpack – WP Security, Backup, Speed, & Growth 16.1 - 16.1.2 - Authenticated (Administrator+) PHP Object Injection Medium

September 5, 2026 Patched in ["16.1.3"]

Jetpack 12.0 - 16.1.2 - Authenticated (Administrator+) PHP Object Injection High

September 3, 2026 Patched in ["12.0.3","12.1.3","12.2.3","12.3.2","12.4.2","12.5.2","12.6.4","12.7.3","12.8.3","12.9.5","13.0.2","13.1.5","13.2.4","13.3.3","13.4.5","13.5.2","13.6.2","13.7.2","13.8.3","13.9.2","14.0.1","14.1.1","14.2.2","14.3.1","14.4.2","14.5.1","14.6.1","14.7.1","14.8.1","14.9.2","15.0.3","15.1.2","15.2.1","15.3.2","15.4.1","15.5.1","15.6.1","15.7.2","15.8.1","15.9.2","16.0.2","16.1.3"]

Jetpack 14.5 - 16.1.2 - Reflected to Stored Cross-Site Scripting via Reader Repost Parameters Medium

September 3, 2026 Patched in ["14.5.1","14.6.1","14.7.1","14.8.1","14.9.2","15.0.3","15.1.2","15.2.1","15.3.2","15.4.1","15.5.1","15.6.1","15.7.2","15.8.1","15.9.2","16.0.2","16.1.3"]

Jetpack 3.2 - 16.1.2 - Missing Authorization on WPCOM Media API Attachment Parent Medium

September 3, 2026 Patched in ["16.1.3"]

Jetpack 13.0 - 14.0 - Reflected DOM-based Cross-Site Scripting Medium

December 4, 2024 Patched in ["14.1"] CVE-2024-10858

Jetpack <= 13.7 - Unauthenticated Arbitrary Block & Shortcode Execution Medium

October 17, 2024 Patched in ["13.8"] CVE-2024-10075

Jetpack <= 13.7 & Jetpack Boost <= 3.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting Medium

October 17, 2024 Patched in ["13.8"] CVE-2024-10076

Jetpack < 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure Medium

October 14, 2024 Patched in ["10.0.2","10.1.2","10.2.3","10.3.2","10.4.2","10.5.3","10.6.2","10.7.2","10.8.2","10.9.3","11.0.2","11.1.4","11.2.2","11.3.4","11.4.2","11.5.3","11.6.2","11.7.3","11.8.6","11.9.3","12.0.2","12.1.2","12.2.2","12.3.1","12.4.1","12.5.1","12.6.3","12.7.2","12.8.2","12.9.4","13.0.1","13.1.4","13.2.3","13.3.2","13.4.4","13.5.1","13.6.1","13.7.1","13.8.2","13.9.1","3.9.10","4.0.7","4.1.4","4.2.5","4.3.5","4.4.5","4.5.3","4.6.3","4.7.4","4.8.5","4.9.3","5.0.3","5.1.4","5.2.5","5.3.4","5.4.4","5.5.5","5.6.5","5.7.5","5.8.4","5.9.4","6.0.4","6.1.5","6.2.5","6.3.7","6.4.6","6.5.4","6.6.5","6.7.4","6.8.5","6.9.4","7.0.5","7.1.5","7.2.5","7.3.5","7.4.5","7.5.7","7.6.4","7.7.6","7.8.4","7.9.4","8.0.3","8.1.4","8.2.6","8.3.3","8.4.5","8.5.3","8.6.4","8.7.4","8.8.5","8.9.4","9.0.5","9.1.3","9.2.4","9.3.5","9.4.4","9.5.5","9.6.4","9.7.3","9.8.3","9.9.3"] CVE-2024-9926

Jetpack – WP Security, Backup, Speed, & Growth <= 13.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpvideo Shortcode Medium

May 13, 2024 Patched in ["13.4"] CVE-2024-4392

Jetpack <= 12.8-a.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via block attribute Medium

November 16, 2023 Patched in ["12.8-a.3"] CVE-2023-45050

Jetpack < 12.7 - Authenticated(Contributor+) Clickjacking via Iframe Injection Medium

November 16, 2023 Patched in ["12.7"] CVE-2023-47774

Jetpack <= 12.6.2 - Improper Authorization via WPCom External Media REST endpoints Medium

November 16, 2023 Patched in ["12.7"] CVE-2023-47788

Jetpack <= 12.1 - Authenticated (Author+) Arbitrary File Manipulation Medium

May 30, 2023 Patched in ["10.0.1","10.1.1","10.2.2","10.3.1","10.4.1","10.5.2","10.6.2","10.7.1","10.8.1","10.9.2","11.0.1","11.1.3","11.2.1","11.3.3","11.4.1","11.5.2","11.6.1","11.7.2","11.8.5","11.9.2","12.0.1","12.1.1","2.0.9","2.1.7","2.2.10","2.3.10","2.4.7","2.5.5","2.6.6","2.7.5","2.8.5","2.9.6","3.0.6","3.1.5","3.2.5","3.3.6","3.4.6","3.5.6","3.6.4","3.7.5","3.8.5","3.9.9","4.0.6","4.1.3","4.2.4","4.3.4","4.4.4","4.5.2","4.6.2","4.7.3","4.8.4","4.9.2","5.0.2","5.1.3","5.2.4","5.3.3","5.4.3","5.5.4","5.6.4","5.7.4","5.8.3","5.9.3","6.0.3","6.1.4","6.2.4","6.3.6","6.4.5","6.5.3","6.6.4","6.7.3","6.8.4","6.9.3","7.0.4","7.1.4","7.2.4","7.3.4","7.4.4","7.5.6","7.6.3","7.7.5","7.8.3","7.9.3","8.0.2","8.1.3","8.2.5","8.3.2","8.4.4","8.5.2","8.6.3","8.7.3","8.8.4","8.9.3","9.0.4","9.1.2","9.2.3","9.3.4","9.4.3","9.5.4","9.6.3","9.7.2","9.8.2","9.9.2"] CVE-2023-2996

JetPack <= 9.7 - Information Disclosure Medium

June 1, 2021 Patched in ["2.0.8","2.1.6","2.2.9","2.3.9","2.4.6","2.5.4","2.6.5","2.7.4","2.8.4","2.9.5","3.0.5","3.1.4","3.2.4","3.3.5","3.4.5","3.5.5","3.6.3","3.7.4","3.8.4","3.9.8","4.0.5","4.1.2","4.2.3","4.3.3","4.4.3","4.5.1","4.6.1","4.7.2","4.8.3","4.9.1","5.0.1","5.1.2","5.2.3","5.3.2","5.4.2","5.5.3","5.6.3","5.7.3","5.8.2","5.9.2","6.0.2","6.1.3","6.2.3","6.3.5","6.4.4","6.5.2","6.6.3","6.7.2","6.8.3","6.9.2","7.0.3","7.1.3","7.2.3","7.3.3","7.4.3","7.5.5","7.6.2","7.7.4","7.8.2","7.9.2","8.0.1","8.1.2","8.2.4","8.3.1","8.4.3","8.5.1","8.6.2","8.7.2","8.8.3","8.9.2","9.0.3","9.1.1","9.2.2","9.3.3","9.4.2","9.5.3","9.6.2","9.7.1"] CVE-2021-24374

Jetpack <= 7.9 - Stored Cross-Site Scripting Medium

October 19, 2019 Patched in ["5.1.1","5.2.2","5.3.1","5.4.1","5.5.2","5.6.2","5.7.2","5.8.1","5.9.1","6.0.1","6.1.2","6.2.2","6.3.4","6.4.3","6.5.1","6.6.2","6.7.1","6.8.2","6.9.1","7.0.2","7.1.2","7.2.2","7.3.2","7.4.2","7.5.4","7.6.1","7.7.3","7.8.1","7.9.1"]

Jetpack < 7.0.1 - Cross-Site Scripting Medium

February 14, 2019 Patched in ["7.0.1"]

Jetpack <= 6.4.2 - Cross-Site Scripting via post_meta Medium

December 11, 2018 Patched in ["6.5"]

Jetpack <= 4.0.2 - Cross-Site Scripting Medium

April 26, 2017 Patched in ["4.0.3"] CVE-2016-10706

Jetpack – WP Security, Backup, Speed, & Growth < 4.2 - Reflected Cross-Site Scripting Medium

April 26, 2017 Patched in ["4.2"]

Jetpack – WP Security, Backup, Speed, & Growth < 4.2 - CSV Injection Critical

April 26, 2017 Patched in ["4.2"]

Jetpack – WP Security, Backup, Speed, & Growth < 4.2 - Timing Attack Critical

April 26, 2017 Patched in ["4.2"]

Jetpack <= 4.0.3 - Cross-Site Scripting Medium

June 20, 2016 Patched in ["4.0.4"] CVE-2016-10705

Jetpack – WP Security, Backup, Speed, & Growth <= 3.9.1 - Cross-Site Scripting via LaTeX markup within HTML elements Medium

February 25, 2016 Patched in ["3.9.2"]

Jetpack – WP Security, Backup, Speed, & Growth <= 3.9.1 - Sensitive Information Disclosure Medium

February 25, 2016 Patched in ["3.9.2"]

Jetpack <= 3.7.1 - Information disclosure Medium

October 1, 2015 Patched in ["3.7.2"]

Jetpack <= 3.7.1 - Stored Cross-Site Scripting High

October 1, 2015 Patched in ["3.7.2"]

Jetpack <= 3.5.2 - Cross-Site Scripting High

May 6, 2015 Patched in ["3.5.3"]

Jetpack <= 3.4.2 - Reflected Cross-Site Scripting Medium

April 20, 2015 Patched in ["3.4.3"] CVE-2015-9359

Jetpack < 2.9.3 - Security Bypass Medium

August 26, 2014 Patched in ["1.9.4","2.0.9","2.1.4","2.2.7","2.3.7","2.4.4","2.5.2","2.6.3","2.7.2","2.8.2","2.9.3"] CVE-2014-0173

What It Does

Jetpack is a multi-purpose plugin from Automattic that bundles security (malware scanning, brute-force protection, a web application firewall), automated backups, performance tools (image CDN, lazy loading, downtime monitoring), and growth features (analytics, social sharing, related posts). Most of its functionality depends on connecting the site to WordPress.com, which is required to activate backups, scans, and several other modules. The free tier covers basic stats, social sharing, and CDN delivery, while security and backups sit behind paid plans.

Who It's For

This plugin is a strong fit for site owners who want one tool that handles security, backups, performance, and basic analytics in a single dashboard, rather than juggling four or five separate plugins. It pairs especially well with sites already linked to WordPress.com or hosted on Pressable, and with non-technical users who value a simple setup over deep configuration.

Who Should Skip It

Skip Jetpack if you already use dedicated tools like UpdraftPlus for backups and Wordfence for security, since Jetpack's strengths overlap heavily with these and you will likely pay for features you do not need. Developers and performance-focused users should also avoid it, because some modules load external scripts and the bundle adds weight that single-purpose plugins do not.

The Bottom Line

Jetpack delivers real value as a swiss-army-knife plugin and scores a strong 93.19 out of 100 here, but it is not the cheapest or lightest option for any single task. If you only need backup, only need security, or strongly prefer keeping your site independent from WordPress.com, a dedicated plugin will serve you better. For everyone else, especially small business owners running a single WordPress site, it remains a sensible all-in-one choice.

Pick Really Simple SSL instead if your only concern is HTTPS, mixed-content fixes, and light security headers, where it scores higher than Jetpack without the WordPress.com dependency.

UpdraftPlus: WP Backup and Migration Plugin 98/100

Choose UpdraftPlus over Jetpack if you want free, self-contained backups stored on your own S3, Google Drive, or Dropbox without paying for Jetpack Vaultpress.

All-in-One WP Migration and Backup 98/100

Use All-in-One WP Migration when site migration and one-click restores matter more than continuous backups or security features.

Wordfence Security: Firewall, Malware Scan, and Login Security 97/100

Pick Wordfence if you want a firewall and malware scanner that runs entirely on your own server, free of charge, instead of routing through WordPress.com.

Duplicator: Backups and Migration Plugin 95/100

Choose Duplicator if your primary need is manual or scheduled backups plus one-click site cloning and migration to a new host.