WordPress · disclosed reports
Cross-site Scripting
16 disclosed reports · $0 paid · 15 valid · 1 informative
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. A report opens its page here: our analysis where there is one, and the link to HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.
Open WordPress on HackerOne- reports
- 16
- valid
- 15
- paid a bounty
- 0
Every one of the 16 is a mark on the map. Named now: 1 to 16, most upvoted first.
- wp-embed XSS on Safari
- "Bad Protocols Validation" Bypass in "wp_kses_bad_protocol_once" using HTML-encoding without trailing semicolons
- [mercantile.wordpress.org] Reflected XSS via AngularJS Template Injection
- Authenticated Stored Cross-site Scripting in bbPress
- XSS via unicode characters in upload filename
- DOM Based XSS In mercantile.wordpress.org
- Large-site Quick Edit reparses a Contributor display name into active HTML
- [FG-VD-18-165] Wordpress Cross-Site Scripting Vulnerability Notification II
- XSS in the search bar of mercantile.wordpress.org
- Reflected XSS at https://da.wordpress.org/themes/?s= via "s=" parameter
- Reflected XSS: Taxonomy Converter via tax parameter
- Authenticated Cross-site Scripting in Template Name
- Stored XSS in Post Preview as Contributor
- [mercantile.wordpress.org] Reflected XSS
- Lack of Sanitization and Insufficient Authentication
- Stored XSS in WordPress
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.