WordPress · disclosed reports
Cross-site Scripting
32 disclosed reports · $0 paid · 32 valid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. A report opens its page here: our analysis where there is one, and the link to HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.
Open WordPress on HackerOne- reports
- 32
- valid
- 32
- paid a bounty
- 0
Every one of the 32 is a mark on the map. Named now: 1 to 26, most upvoted first.
- Stored XSS Vulnerability
- Stored XSS in Private Message component (BuddyPress)
- Stored XSS on byddypress Plug-in via groups name
- Reflected XSS on https://make.wordpress.org via 'channel' parameter
- Potential unprivileged Stored XSS through wp_targeted_link_rel
- wp-embed XSS on Safari
- Multiple stored XSS in WordPress
- "Bad Protocols Validation" Bypass in "wp_kses_bad_protocol_once" using HTML-encoding without trailing semicolons
- Author → stored XSS in wp-admin: unescaped sub-size filename from attachment metadata breaks out of the `src` attribute in `get_media_item()`
- [mercantile.wordpress.org] Reflected XSS via AngularJS Template Injection
- Authenticated Stored Cross-site Scripting in bbPress
- Stored XSS on Broken Themes via filename
- Wordpress 4.7.2 - Two XSS in Media Upload when file too large.
- XSS via unicode characters in upload filename
- DOM Based XSS In mercantile.wordpress.org
- Large-site Quick Edit reparses a Contributor display name into active HTML
- [FG-VD-18-165] Wordpress Cross-Site Scripting Vulnerability Notification II
- XSS in the search bar of mercantile.wordpress.org
- Reflected XSS at https://da.wordpress.org/themes/?s= via "s=" parameter
- Reflected XSS: Taxonomy Converter via tax parameter
- Stored self-XSS in mercantile.wordpress.org checkout
- Authenticated Cross-site Scripting in Template Name
- Stored XSS in Post Preview as Contributor
- [mercantile.wordpress.org] Reflected XSS
- pre-auth Stored XSS in comments via javascript: url when administrator edits user supplied comment
- Stored xss via template injection
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.