Jetpack – WP Security, Backup, Speed, & Growth

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Refined from the date this plugin crossed into its current band.

A large install base, a clear pro tier and a steady trend. As reliable as an outside estimate gets.

The newest reviews report an unwanted AI writing prompt, an unescaped-HTML bug breaking Elementor editing, and a stats plugin that broke a site on reactivation, a sharp drop from the mostly positive older reviews.

1. ★★★★★ Ronald Joseph Legarski, Jr.

   1mo ago

   A great tool for mobile management.

   Read on wp.org ↗
2. ★★★★★ allancav

   1mo ago

   What a shame to see Jetpack join the”if we just stick AI in everything we can claim everyone as a user” school of thought. On updating there was an AI writing “prompt” right on my dashboard. I know I can hide it but I also know my site is connected to an AI now with no apparent way to opt out or uninstall short of uninstalling Jetpack altogether. I don’t need a gen AI writing prompt. I’m not stupid. I’m as able to write now as I was before this snake oil was poured into everything. Give me an gen-AI free version, I do not want this trash on my dash. This topic was modified 5 days, 22 hours ago by allancav. Reason: Original 5 star grade was a mistake

   Read on wp.org ↗
3. ★★★★★ Ermelindo João Rosário

   2mo ago

   Please Stats for free, i don’t have money to pay for stats

   Read on wp.org ↗
4. ★★★★★ pondsolutions

   2mo ago

   This gave me a really hard time to troubleshoot, the jetpack plugin injected inside ElementorConfig raw HTML, but the quotes around "ignore" are not escaped, so JavaScript reads it as broken syntax. Gave console error: Unexpected identifier ‘ignore’. Editing with elementor only worked on safemode and this plugin was the culprit. Wasted almost 3 hours troubleshooting. Very sad of once was a great plugin. Immediately I disabled the plugin the edit with elementor page quickly and immediately loaded and worked perfectly. Such a bummer, I will have to keep it disabled for now. I was thinking of upgrading but not after this.

   Read on wp.org ↗
5. ★★★★★ byermedia

   3mo ago

   I have used this plugin for a long time on all my WP websites, I like it of the options, beautiful images gallery, and stats. however a couple of years ago the photos gallery caused lots of problems with images. I stopped using the gallery options. This last time was the final straw, I just wanted to track stats to compare, It broke my website, I Deactivated, problem went away, Activated came back, waited for update and reactivated, problem continued. done!.

   Read on wp.org ↗
6. ★★★★★ avrentzos

   3mo ago

   Μεγάλη βοήθεια από το συγκεκριμένο plugin

   Read on wp.org ↗
7. ★★★★★ editordev

   3mo ago

   Superbbbbb….

   Read on wp.org ↗
8. ★★★★★ Luke

   3mo ago

   Lots of features for free. Stats n backups r helpful. Does feel heavy on smaller sites tho. Still worth it for what u get imo

   Read on wp.org ↗

Recent releases and news for this plugin

1. 2026-08-21 Performance Plugins Need to Keep Pace With WordPress The WP Rocket fatal error around WordPress 7.1 shows why performance plugins must keep pace with core. See how Jetpack handles serious reports and how Jetpack Boost can simplify your performance setup
2. 2026-08-12 Your Next Post Can Be a Podcast Jetpack 16.1 makes starting a podcast easy: simply upload audio to a post and publish. Your episode is distributed across your site, email subscribers, and major podcast platforms automatically. With
3. 2026-06-05 Introducing Site Chat, Powered by Jetpack Search Site Chat gives visitors a new way to explore your site. Readers can ask questions, get answers based on your content, and keep following the threads that brought them there.
4. 2026-05-25 Two new search experiences in Jetpack Search Jetpack Search 3.0 introduces two new ways for visitors to search your site — Embedded and a blocks-powered Overlay — both built from real WordPress blocks that inherit your theme's fonts, colors, and
5. 2026-05-25 A search built for your WooCommerce store Jetpack Search 3.0 ships with a full set of WooCommerce-aware search blocks — filter by product attribute, price, rating, stock status, brand, category, tag — so shoppers can narrow results the way th
6. 2026-05-25 Build your search page with blocks With the new Jetpack Search, your search results page is now a real block template. Open it in the editor, drag in the filters and sort controls you want, design the empty state — the same editor you

25 disclosed vulnerabilities on record for this plugin, all fixed in the current version. Sites on older versions stay exposed until they update.

1. Medium · 6.1 Jetpack 13.0 - 14.0 - Reflected DOM-based Cross-Site Scripting ↗
   2024-12-04 CVE-2024-10858 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects 13.0 - 14.0 Patched in 14.1
2. Medium · 6.5 Jetpack <= 13.7 - Unauthenticated Arbitrary Block & Shortcode Execution ↗
   2024-10-17 CVE-2024-10075 Authorization Bypass Through User-Controlled Key Affects <= 13.7 Patched in 13.8
3. Medium · 6.4 Jetpack <= 13.7 & Jetpack Boost <= 3.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
   2024-10-17 CVE-2024-10076 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 13.7 Patched in 13.8
4. Medium · 4.3 Jetpack < 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure ↗
   2024-10-14 CVE-2024-9926 Missing Authorization Affects 10.0 - 10.0.1 Patched in 10.0.2
5. Medium · 6.4 Jetpack – WP Security, Backup, Speed, & Growth <= 13.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpvideo Shortcode ↗
   2024-05-13 CVE-2024-4392 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 13.3.1 Patched in 13.4
6. Medium · 6.4 Jetpack <= 12.8-a.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via block attribute ↗
   2023-11-16 CVE-2023-45050 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 12.8-a.1 Patched in 12.8-a.3
7. Medium · 5.0 Jetpack < 12.7 - Authenticated(Contributor+) Clickjacking via Iframe Injection ↗
   2023-11-16 CVE-2023-47774 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Affects < 12.7 Patched in 12.7
8. Medium · 4.3 Jetpack <= 12.6.2 - Improper Authorization via WPCom External Media REST endpoints ↗
   2023-11-16 CVE-2023-47788 Improper Authorization Affects < 12.7 Patched in 12.7
9. Medium · 6.5 Jetpack <= 12.1 - Authenticated (Author+) Arbitrary File Manipulation ↗
   2023-05-30 CVE-2023-2996 Improper Input Validation Affects 10.0 Patched in 10.0.1
10. Medium · 5.3 JetPack <= 9.7 - Information Disclosure ↗
    2021-06-01 CVE-2021-24374 Exposure of Sensitive Information to an Unauthorized Actor Affects 2.0 - 2.0.8 Patched in 2.0.8
11. Medium · 6.4 Jetpack <= 7.9 - Stored Cross-Site Scripting ↗
    2019-10-19 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 5.1 Patched in 5.1.1
12. Medium · 6.1 Jetpack < 7.0.1 - Cross-Site Scripting ↗
    2019-02-14 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 7.0 Patched in 7.0.1
13. Medium · 5.4 Jetpack <= 6.4.2 - Cross-Site Scripting via post_meta ↗
    2018-12-11 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 6.4.2 Patched in 6.5
14. Medium · 6.1 Jetpack <= 4.0.2 - Cross-Site Scripting ↗
    2017-04-26 CVE-2016-10706 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 4.0.3 Patched in 4.0.3
15. Medium · 6.1 Jetpack – WP Security, Backup, Speed, & Growth < 4.2 - Reflected Cross-Site Scripting ↗
    2017-04-26 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 4.2 Patched in 4.2
16. Critical · 9.6 Jetpack – WP Security, Backup, Speed, & Growth < 4.2 - CSV Injection ↗
    2017-04-26 Improper Neutralization of Formula Elements in a CSV File Affects < 4.2 Patched in 4.2
17. Critical · 9.8 Jetpack – WP Security, Backup, Speed, & Growth < 4.2 - Timing Attack ↗
    2017-04-26 Observable Timing Discrepancy Affects < 4.2 Patched in 4.2
18. Medium · 6.1 Jetpack <= 4.0.3 - Cross-Site Scripting ↗
    2016-06-20 CVE-2016-10705 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 4.0.4 Patched in 4.0.4
19. Medium · 6.1 Jetpack – WP Security, Backup, Speed, & Growth <= 3.9.1 - Cross-Site Scripting via LaTeX markup within HTML elements ↗
    2016-02-25 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 3.9.1 Patched in 3.9.2
20. Medium · 4.9 Jetpack – WP Security, Backup, Speed, & Growth <= 3.9.1 - Sensitive Information Disclosure ↗
    2016-02-25 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 3.9.1 Patched in 3.9.2
21. Medium · 5.3 Jetpack <= 3.7.1 - Information disclosure ↗
    2015-10-01 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 3.7.1 Patched in 3.7.2
22. High · 7.2 Jetpack <= 3.7.1 - Stored Cross-Site Scripting ↗
    2015-10-01 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 3.7.1 Patched in 3.7.2
23. High · 7.2 Jetpack <= 3.5.2 - Cross-Site Scripting ↗
    2015-05-06 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 3.5.2 Patched in 3.5.3
24. Medium · 6.1 Jetpack <= 3.4.2 - Reflected Cross-Site Scripting ↗
    2015-04-20 CVE-2015-9359 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 3.4.3 Patched in 3.4.3
25. Medium · 5.3 Jetpack < 2.9.3 - Security Bypass ↗
    2014-08-26 CVE-2014-0173 Improper Authorization Affects <= 1.8 Patched in 1.9.4

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0.1

Translated into 85 languages, 21 at 90% or more

Plus 61 more locales with partial translations.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2025-12-25 4M+ → 3M+ down after 1 days in tier
2. 2025-12-24 3M+ → 4M+ up after 1 days in tier
3. 2025-12-23 4M+ → 3M+ down after 10 days in tier
4. 2025-12-13 3M+ → 4M+ up after 1 days in tier
5. 2025-12-12 4M+ → 3M+ down after 610 days in tier
6. 2024-04-11 5M+ → 4M+ down

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• ManageWP Worker 1M+ installs · 4.6★ · 3 shared tags A
• Sucuri Security – Auditing, Malware Scanner and Security Hardening 600K+ installs · 4.2★ · 3 shared tags A
• Jetpack Protect 100K+ installs · 4.6★ · 3 shared tags A
• Wordfence Security – Firewall, Malware Scan, and Login Security 5M+ installs · 4.7★ · 2 shared tags A
• Kadence Security – Password, Two Factor Authentication, and Brute Force Protection 700K+ installs · 4.6★ · 2 shared tags A
• InfiniteWP Client 200K+ installs · 4.4★ · 2 shared tags A

Embed this report card

Drop a live Pulse card for Jetpack – WP Security, Backup, Speed, & Growth into a readme, a review or a deck. It updates itself.

Jetpack – WP Security, Backup, Speed, & Growth: 3M+ active installs, 3.8★ (2,405 reviews). Plugin Pulse (WP Mayor), as of 2026-08-26. https://plugins.wpmayor.com/plugin/jetpack