Automattic · disclosed reports
Cross-site Scripting
57 disclosed reports · $0 paid · 56 valid · 1 informative
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. A report opens its page here: our analysis where there is one, and the link to HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.
Open Automattic on HackerOne- reports
- 57
- valid
- 56
- paid a bounty
- 0
Every one of the 57 is a mark on the map. Named now: 1 to 26, most upvoted first.
- Stored XSS in wordpress.com
- Stored XSS vulnerability in comments on *.wordpress.com
- XSS in Email Input [intensedebate.com]
- Stored XSS on app.crowdsignal.com + your-subdomain.survey.fm via Embed Media
- DOM XSS on multiple Automattic domains through postMessages
- DOM-Based XSS in tumblr.com
- Stored XSS on https://app.crowdsignal.com/surveys/[Survey-Id]/question - Bypass
- Reflected XSS in https://www.intensedebate.com/js/getCommentLink.php
- WordPress Flash XSS in *flashmediaelement.swf*
- Stored Self XSS on https://app.crowdsignal.com (in Photo Insert App) + Stored XSS on https://*your-subdomain*.survey.fm
- Stored XSS on wordpress.com
- XSS and HTML Injection on the pressable.com search box
- DOM-Based XSS in tumblr.com
- Stored XSS in Intense Debate comment system
- Stored XSS in wordpress.com
- reflected xss in https://wordpress.com/start/account/user
- [intensedebate.com] XSS Reflected POST-Based
- Stored XSS in Jetpack's Simple Payment Module by Contributors / Authors
- WooCommerce: Persistent XSS via customer address (state/county)
- DOM based XSS in the WooCommerce plugin
- Stored XSS on app.crowdsignal.com your-subdomain.crowdsignal.net via Thank You Header
- SSRF & Blind XSS in Gravatar email
- Stored XSS on wordpress.com
- [FG-VD-19-022] Wordpress WooCommerce Cross-Site Scripting Vulnerability Notification
- [intensedebate.com] XSS Reflected POST-Based on update/tumblr2/{$id}
- [tumblr.com] 69< Firefox Only XSS Reflected
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.