Bug bounty program · HackerOne
Most upvoted reports96
- #643908ValidAnalysedStored XSS VulnerabilityWordPress · Cross-site Scripting · 2019 · needs: a user account · Stored XSS–403votes
- #487081ValidAnalysedStored XSS in Private Message component (BuddyPress)WordPress · Cross-site Scripting · 2019 · needs: a user account · Stored XSS–337votes
- #436928ValidRCE as Admin defeats WordPress hardening and file permissionsWordPress · File and Path Handling · 2020–164votes
- #592316ValidStored XSS on byddypress Plug-in via groups nameWordPress · Cross-site Scripting · 2019–132votes
- #205481ValidWordpress unzip_file path traversalWordPress · Misconfiguration and Insecure Design · 2020–119votes
- #659419ValidReflected XSS on https://make.wordpress.org via 'channel' parameterWordPress · Cross-site Scripting · 2019–97votes
- #428019ValidCSRF to HTML Injection in CommentsWordPress · Cross-Site Request Forgery · 2019–95votes
- #1107282ValidPrivilege Escalation via REST API to Administrator leads to RCEWordPress · Access Control · 2021–92votes
- #921709ValidClickjacking on donation pageWordPress · Misconfiguration and Insecure Design · 2020–90votes
- #509930ValidPotential unprivileged Stored XSS through wp_targeted_link_relWordPress · Cross-site Scripting · 2020–80votes
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.