Jetpack – AI Agents & MCP, Security, Backup & Analytics

The newest reviews report an unwanted AI writing prompt, an unescaped-HTML bug breaking Elementor editing, and a stats plugin that broke a site on reactivation, a sharp drop from the mostly positive older reviews.

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory searches this plugin turns up in, and which way each one is moving. WordPress.org publishes no history of search positions, so this starts the day we first tracked a keyword and never backfills.

wp.org is where the directory puts the plugin for that search. On merit is where it would sit if results were ranked on rating, support and updates, without the install boost. The last column is how far the wp.org position moved, from our first reading in the last 90 days to the latest.

5972 searches this plugin appeared in over the last 90 days, 20 listed. 5738 left out as unrelated or noise (years, numbers, stray words).

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Crossed into this band 10 months ago; a band this size takes about a year or more to cross, which places it about 50% of the way through.

1. ★★★★★ Ronald Joseph Legarski, Jr.

   4mo ago

   A great tool for mobile management.

   Read on wp.org ↗
2. ★★★★★ allancav

   4mo ago

   What a shame to see Jetpack join the”if we just stick AI in everything we can claim everyone as a user” school of thought. On updating there was an AI writing “prompt” right on my dashboard. I know I can hide it but I also know my site is connected to an AI now with no apparent way to opt out or uninstall short of uninstalling Jetpack altogether. I don’t need a gen AI writing prompt. I’m not stupid. I’m as able to write now as I was before this snake oil was poured into everything. Give me an gen-AI free version, I do not want this trash on my dash. This topic was modified 5 days, 22 hours ago by allancav. Reason: Original 5 star grade was a mistake

   Read on wp.org ↗
3. ★★★★★ Ermelindo João Rosário

   4mo ago

   Please Stats for free, i don’t have money to pay for stats

   Read on wp.org ↗
4. ★★★★★ pondsolutions

   4mo ago

   This gave me a really hard time to troubleshoot, the jetpack plugin injected inside ElementorConfig raw HTML, but the quotes around "ignore" are not escaped, so JavaScript reads it as broken syntax. Gave console error: Unexpected identifier ‘ignore’. Editing with elementor only worked on safemode and this plugin was the culprit. Wasted almost 3 hours troubleshooting. Very sad of once was a great plugin. Immediately I disabled the plugin the edit with elementor page quickly and immediately loaded and worked perfectly. Such a bummer, I will have to keep it disabled for now. I was thinking of upgrading but not after this.

   Read on wp.org ↗
5. ★★★★★ byermedia

   5mo ago

   I have used this plugin for a long time on all my WP websites, I like it of the options, beautiful images gallery, and stats. however a couple of years ago the photos gallery caused lots of problems with images. I stopped using the gallery options. This last time was the final straw, I just wanted to track stats to compare, It broke my website, I Deactivated, problem went away, Activated came back, waited for update and reactivated, problem continued. done!.

   Read on wp.org ↗
6. ★★★★★ avrentzos

   5mo ago

   Μεγάλη βοήθεια από το συγκεκριμένο plugin

   Read on wp.org ↗
7. ★★★★★ editordev

   5mo ago

   Superbbbbb….

   Read on wp.org ↗
8. ★★★★★ Luke

   5mo ago

   Lots of features for free. Stats n backups r helpful. Does feel heavy on smaller sites tho. Still worth it for what u get imo

   Read on wp.org ↗

Recent releases and news for this plugin

1. 2026-10-23 Tell us what Jetpack should build next Jetpack now has a public feature request board. It’s one place to tell us what you want Jetpack to do next, see what other people are asking for, and follow along as we decide. Start with what’s alrea
2. 2026-10-15 Where to start with Jetpack in ChatGPT The WordPress plugin is now available in ChatGPT. It’s ready for your first prompt, but where to start? Jetpack handles the stuff that you’re probably thinking about all the time. Backups, security, a
3. 2026-10-07 Jetpack 16.3: Conditional logic in Forms, new playlist blocks, and more Show form fields only when they’re needed, add video playlists that update themselves, and manage every Jetpack feature from one place. 16.3
4. 2026-10-02 The new Jetpack.com, one month in A month after launch, here's what changed on Jetpack.com, how we built it as a WordPress block theme with its content in git, and what that lets us do now.
5. 2026-09-24 VideoPress now supports playlists VideoPress now lets you build video playlists and share them right on your own site.
6. 2026-09-16 Build a WordPress Site with ChatGPT or Claude With Jetpack AI, your assistant can work directly on your site to create pages, change your design, keep plugins up to date, and manage WordPress with natural language.

All 33 disclosed vulnerabilities are patched in the current version (16.3.1). Sites still on an older version should update.

1. Patched Medium · 5.3 Jetpack – WP Security, Backup, Speed, & Growth <= 16.2 - Missing Authorization ↗
   2026-10-07 CVE-2026-106601 Missing Authorization Affects <= 16.2 Patched in 16.3
2. Patched Medium · 5.3 Jetpack – WP Security, Backup, Speed, & Growth <= 16.2 - Missing Authorization ↗
   2026-10-07 CVE-2026-106602 Missing Authorization Affects <= 16.2 Patched in 16.3
3. Patched High · 7.2 Jetpack – WP Security, Backup, Speed, & Growth 16.1 - 16.1.2 - Unauthenticated Stored Cross-Site Scripting ↗
   2026-09-08 Improper Neutralization of Input During Web Page Generation Affects 16.1 - 16.1.2 Patched in 16.1.3
4. Patched Medium · 6.6 Jetpack – WP Security, Backup, Speed, & Growth 16.1 - 16.1.2 - Authenticated (Administrator+) PHP Object Injection ↗
   2026-09-05 Deserialization of Untrusted Data Affects 16.1 - 16.1.2 Patched in 16.1.3
5. Patched Medium · 6.6 Jetpack – WP Security, Backup, Speed, & Growth 16.1 - 16.1.2 - Authenticated (Administrator+) PHP Object Injection ↗
   2026-09-05 Deserialization of Untrusted Data Affects 16.1 - 16.1.2 Patched in 16.1.3
6. Patched High · 7.2 Jetpack 12.0 - 16.1.2 - Authenticated (Administrator+) PHP Object Injection ↗
   2026-09-03 Deserialization of Untrusted Data Affects 12.0 - 12.0.2 Patched in 12.0.3
7. Patched Medium · 6.1 Jetpack 14.5 - 16.1.2 - Reflected to Stored Cross-Site Scripting via Reader Repost Parameters ↗
   2026-09-03 Improper Neutralization of Input During Web Page Generation Affects 14.5 Patched in 14.5.1
8. Patched Medium · 4.3 Jetpack 3.2 - 16.1.2 - Missing Authorization on WPCOM Media API Attachment Parent ↗
   2026-09-03 Missing Authorization Affects 3.2 - 16.1.2 Patched in 16.1.3
9. Patched Medium · 6.1 Jetpack 13.0 - 14.0 - Reflected DOM-based Cross-Site Scripting ↗
   2024-12-04 CVE-2024-10858 Improper Neutralization of Input During Web Page Generation Affects 13.0 - 14.0 Patched in 14.1
10. Patched Medium · 6.5 Jetpack <= 13.7 - Unauthenticated Arbitrary Block & Shortcode Execution ↗
    2024-10-17 CVE-2024-10075 Authorization Bypass Through User-Controlled Key Affects <= 13.7 Patched in 13.8
11. Patched Medium · 6.4 Jetpack <= 13.7 & Jetpack Boost <= 3.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2024-10-17 CVE-2024-10076 Improper Neutralization of Input During Web Page Generation Affects <= 13.7 Patched in 13.8
12. Patched Medium · 4.3 Jetpack < 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure ↗
    2024-10-14 CVE-2024-9926 Missing Authorization Affects 10.0 - 10.0.1 Patched in 10.0.2
13. Patched Medium · 6.4 Jetpack – WP Security, Backup, Speed, & Growth <= 13.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpvideo Shortcode ↗
    2024-05-13 CVE-2024-4392 Improper Neutralization of Input During Web Page Generation Affects <= 13.3.1 Patched in 13.4
14. Patched Medium · 6.4 Jetpack <= 12.8-a.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via block attribute ↗
    2023-11-16 CVE-2023-45050 Improper Neutralization of Input During Web Page Generation Affects <= 12.8-a.1 Patched in 12.8-a.3
15. Patched Medium · 5.0 Jetpack < 12.7 - Authenticated(Contributor+) Clickjacking via Iframe Injection ↗
    2023-11-16 CVE-2023-47774 Improper Neutralization of Special Elements in Output Used by a Downstream Component Affects < 12.7 Patched in 12.7
16. Patched Medium · 4.3 Jetpack <= 12.6.2 - Improper Authorization via WPCom External Media REST endpoints ↗
    2023-11-16 CVE-2023-47788 Improper Authorization Affects < 12.7 Patched in 12.7
17. Patched Medium · 6.5 Jetpack <= 12.1 - Authenticated (Author+) Arbitrary File Manipulation ↗
    2023-05-30 CVE-2023-2996 Improper Input Validation Affects 10.0 Patched in 10.0.1
18. Patched Medium · 5.3 JetPack <= 9.7 - Information Disclosure ↗
    2021-06-01 CVE-2021-24374 Exposure of Sensitive Information to an Unauthorized Actor Affects 2.0 - 2.0.8 Patched in 2.0.8
19. Patched Medium · 6.4 Jetpack <= 7.9 - Stored Cross-Site Scripting ↗
    2019-10-19 Improper Neutralization of Input During Web Page Generation Affects < 5.1 Patched in 5.1.1
20. Patched Medium · 6.1 Jetpack < 7.0.1 - Cross-Site Scripting ↗
    2019-02-14 Improper Neutralization of Input During Web Page Generation Affects <= 7.0 Patched in 7.0.1
21. Patched Medium · 5.4 Jetpack <= 6.4.2 - Cross-Site Scripting via post_meta ↗
    2018-12-11 Improper Neutralization of Input During Web Page Generation Affects <= 6.4.2 Patched in 6.5
22. Patched Medium · 6.1 Jetpack <= 4.0.2 - Cross-Site Scripting ↗
    2017-04-26 CVE-2016-10706 Improper Neutralization of Input During Web Page Generation Affects < 4.0.3 Patched in 4.0.3
23. Patched Medium · 6.1 Jetpack – WP Security, Backup, Speed, & Growth < 4.2 - Reflected Cross-Site Scripting ↗
    2017-04-26 Improper Neutralization of Input During Web Page Generation Affects < 4.2 Patched in 4.2
24. Patched Critical · 9.6 Jetpack – WP Security, Backup, Speed, & Growth < 4.2 - CSV Injection ↗
    2017-04-26 Improper Neutralization of Formula Elements in a CSV File Affects < 4.2 Patched in 4.2
25. Patched Critical · 9.8 Jetpack – WP Security, Backup, Speed, & Growth < 4.2 - Timing Attack ↗
    2017-04-26 Observable Timing Discrepancy Affects < 4.2 Patched in 4.2
26. Patched Medium · 6.1 Jetpack <= 4.0.3 - Cross-Site Scripting ↗
    2016-06-20 CVE-2016-10705 Improper Neutralization of Input During Web Page Generation Affects < 4.0.4 Patched in 4.0.4
27. Patched Medium · 6.1 Jetpack – WP Security, Backup, Speed, & Growth <= 3.9.1 - Cross-Site Scripting via LaTeX markup within HTML elements ↗
    2016-02-25 Improper Neutralization of Input During Web Page Generation Affects <= 3.9.1 Patched in 3.9.2
28. Patched Medium · 4.9 Jetpack – WP Security, Backup, Speed, & Growth <= 3.9.1 - Sensitive Information Disclosure ↗
    2016-02-25 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 3.9.1 Patched in 3.9.2
29. Patched Medium · 5.3 Jetpack <= 3.7.1 - Information disclosure ↗
    2015-10-01 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 3.7.1 Patched in 3.7.2
30. Patched High · 7.2 Jetpack <= 3.7.1 - Stored Cross-Site Scripting ↗
    2015-10-01 Improper Neutralization of Input During Web Page Generation Affects <= 3.7.1 Patched in 3.7.2
31. Patched High · 7.2 Jetpack <= 3.5.2 - Cross-Site Scripting ↗
    2015-05-06 Improper Neutralization of Input During Web Page Generation Affects <= 3.5.2 Patched in 3.5.3
32. Patched Medium · 6.1 Jetpack <= 3.4.2 - Reflected Cross-Site Scripting ↗
    2015-04-20 CVE-2015-9359 Improper Neutralization of Input During Web Page Generation Affects < 3.4.3 Patched in 3.4.3
33. Patched Medium · 5.3 Jetpack < 2.9.3 - Security Bypass ↗
    2014-08-26 CVE-2014-0173 Improper Authorization Affects <= 1.8 Patched in 1.9.4

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0.1

Translated into 84 languages, 22 at 90% or more

Plus 60 more locales with partial translations.

Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2025-12-25 4M+ → 3M+ down after 1 days in tier
2. 2025-12-24 3M+ → 4M+ up after 1 days in tier
3. 2025-12-23 4M+ → 3M+ down after 10 days in tier
4. 2025-12-13 3M+ → 4M+ up after 1 days in tier
5. 2025-12-12 4M+ → 3M+ down after 610 days in tier
6. 2024-04-11 5M+ → 4M+ down after 2141 days in tier
7. 2018-06-01 4M+ → 5M+ up after 268 days in tier
8. 2017-09-06 3M+ → 4M+ up after 189 days in tier

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

Embed this report card

Drop a live Pulse card for Jetpack – AI Agents & MCP, Security, Backup & Analytics into a readme, a review or a deck. It updates itself.

Jetpack – AI Agents & MCP, Security, Backup & Analytics: 3M+ active installs, 3.7★ (2,408 reviews). Plugin Pulse (WP Mayor), as of 2026-11-01. https://plugins.wpmayor.com/plugin/jetpack