Bug bounty program
WO
WordPress
Most upvoted reports96
All reports| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| Stored XSS VulnerabilityAnalysed#643908 | Cross-site Scripting | 2019-07-18 | – | 403 |
| Stored XSS in Private Message component (BuddyPress)Analysed#487081 | Cross-site Scripting | 2019-03-08 | – | 337 |
| RCE as Admin defeats WordPress hardening and file permissionsAnalysed#436928 | File and Path Handling | 2020-06-09 | – | 164 |
| Stored XSS on byddypress Plug-in via groups nameAnalysed#592316 | Cross-site Scripting | 2019-07-27 | – | 132 |
| Wordpress unzip_file path traversalAnalysed#205481 | Misconfiguration and Insecure Design | 2020-01-29 | – | 119 |
| Reflected XSS on https://make.wordpress.org via 'channel' parameterAnalysed#659419 | Cross-site Scripting | 2019-08-26 | – | 97 |
| CSRF to HTML Injection in CommentsAnalysed#428019 | Cross-Site Request Forgery | 2019-05-13 | – | 95 |
| Privilege Escalation via REST API to Administrator leads to RCEAnalysed#1107282 | Access Control | 2021-05-17 | – | 92 |
| Clickjacking on donation pageAnalysed#921709 | Misconfiguration and Insecure Design | 2020-07-16 | – | 90 |
| Potential unprivileged Stored XSS through wp_targeted_link_relAnalysed#509930 | Cross-site Scripting | 2020-01-08 | – | 80 |
Subdomains29,502
| Name | Scope | First seen |
|---|---|---|
| mx.wordpress.netmail | In scope | 2026-11-15 |
| owa.wordpress.netmail | In scope | 2026-11-15 |
| imap.wordpress.netmail | In scope | 2026-11-15 |
| mail.wordpress.netmail | In scope | 2026-11-15 |
| pop3.wordpress.netmail | In scope | 2026-11-15 |
| smtp.wordpress.netmail | In scope | 2026-11-15 |
| imap4.wordpress.netmail | In scope | 2026-11-15 |
| mail1.wordpress.netmail | In scope | 2026-11-15 |
| mail2.wordpress.netmail | In scope | 2026-11-15 |
| mail.gt.wordpress.netmail | In scope | 2026-11-15 |
| mail.id.wordpress.netmail | In scope | 2026-11-15 |
| mail.nl.wordpress.netmail | In scope | 2026-11-15 |
| webmail.wordpress.netmail | In scope | 2026-11-15 |
| exchange.wordpress.netmail | In scope | 2026-11-15 |
| mail.faq.wordpress.netmail | In scope | 2026-11-15 |
| mail.2017.wordpress.netmail | In scope | 2026-11-15 |
| mail.2019.wordpress.netmail | In scope | 2026-11-15 |
| mail.2020.wordpress.netmail | In scope | 2026-11-15 |
| mail.2021.wordpress.netmail | In scope | 2026-11-15 |
| mail.2022.wordpress.netmail | In scope | 2026-11-15 |
| mail.jobs.wordpress.netmail | In scope | 2026-11-15 |
| mail.shop.wordpress.netmail | In scope | 2026-11-15 |
| mail.wasm.wordpress.netmail | In scope | 2026-11-15 |
| mail.wp10.wordpress.netmail | In scope | 2026-11-15 |
| mail.wp15.wordpress.netmail | In scope | 2026-11-15 |
| mail.wp20.wordpress.netmail | In scope | 2026-11-15 |
| mail.agnes.wordpress.netmail | In scope | 2026-11-15 |
| mail.norsk.wordpress.netmail | In scope | 2026-11-15 |
| mail.store.wordpress.netmail | In scope | 2026-11-15 |
| webmail.gt.wordpress.netmail | In scope | 2026-11-15 |
| webmail.id.wordpress.netmail | In scope | 2026-11-15 |
| webmail.nl.wordpress.netmail | In scope | 2026-11-15 |
| mail.jptest.wordpress.netmail | In scope | 2026-11-15 |
| mail.yodelt.wordpress.netmail | In scope | 2026-11-15 |
| webmail.faq.wordpress.netmail | In scope | 2026-11-15 |
| autodiscover.wordpress.netmail | In scope | 2026-11-15 |
| webmail.2017.wordpress.netmail | In scope | 2026-11-15 |
| webmail.2019.wordpress.netmail | In scope | 2026-11-15 |
| webmail.2020.wordpress.netmail | In scope | 2026-11-15 |
| webmail.2021.wordpress.netmail | In scope | 2026-11-15 |
| webmail.2022.wordpress.netmail | In scope | 2026-11-15 |
| webmail.jobs.wordpress.netmail | In scope | 2026-11-15 |
| webmail.shop.wordpress.netmail | In scope | 2026-11-15 |
| webmail.wasm.wordpress.netmail | In scope | 2026-11-15 |
| webmail.wp10.wordpress.netmail | In scope | 2026-11-15 |
| webmail.wp15.wordpress.netmail | In scope | 2026-11-15 |
| webmail.wp20.wordpress.netmail | In scope | 2026-11-15 |
| mail.malaysia.wordpress.netmail | In scope | 2026-11-15 |
| mail.redirect.wordpress.netmail | In scope | 2026-11-15 |
| webmail.agnes.wordpress.netmail | In scope | 2026-11-15 |
| webmail.norsk.wordpress.netmail | In scope | 2026-11-15 |
| webmail.store.wordpress.netmail | In scope | 2026-11-15 |
| mail.unittests.wordpress.netmail | In scope | 2026-11-15 |
| webmail.jptest.wordpress.netmail | In scope | 2026-11-15 |
| webmail.yodelt.wordpress.netmail | In scope | 2026-11-15 |
| mail.2021blocks.wordpress.netmail | In scope | 2026-11-15 |
| mail.masterplan.wordpress.netmail | In scope | 2026-11-15 |
| mail.playground.wordpress.netmail | In scope | 2026-11-15 |
| mail.wordcamptv.wordpress.netmail | In scope | 2026-11-15 |
| mail.devdocsbeta.wordpress.netmail | In scope | 2026-11-15 |
| mail.projectpier.wordpress.netmail | In scope | 2026-11-15 |
| mail.themebuster.wordpress.netmail | In scope | 2026-11-15 |
| mail.themetester.wordpress.netmail | In scope | 2026-11-15 |
| mail.wasm-worker.wordpress.netmail | In scope | 2026-11-15 |
| webmail.malaysia.wordpress.netmail | In scope | 2026-11-15 |
| webmail.redirect.wordpress.netmail | In scope | 2026-11-15 |
| autodiscover.jobs.wordpress.netmail | In scope | 2026-11-15 |
| mail.install4free.wordpress.netmail | In scope | 2026-11-15 |
| mail.themebreaker.wordpress.netmail | In scope | 2026-11-15 |
| mail.themecrafter.wordpress.netmail | In scope | 2026-11-15 |
| webmail.unittests.wordpress.netmail | In scope | 2026-11-15 |
| autodiscover.agnes.wordpress.netmail | In scope | 2026-11-15 |
| autodiscover.store.wordpress.netmail | In scope | 2026-11-15 |
| mail.sparklemotion.wordpress.netmail | In scope | 2026-11-15 |
| webmail.2021blocks.wordpress.netmail | In scope | 2026-11-15 |
| webmail.masterplan.wordpress.netmail | In scope | 2026-11-15 |
| webmail.playground.wordpress.netmail | In scope | 2026-11-15 |
| webmail.wordcamptv.wordpress.netmail | In scope | 2026-11-15 |
| webmail.devdocsbeta.wordpress.netmail | In scope | 2026-11-15 |
| webmail.projectpier.wordpress.netmail | In scope | 2026-11-15 |
| webmail.themebuster.wordpress.netmail | In scope | 2026-11-15 |
| webmail.themetester.wordpress.netmail | In scope | 2026-11-15 |
| mail.mt-export-split.wordpress.netmail | In scope | 2026-11-15 |
| webmail.install4free.wordpress.netmail | In scope | 2026-11-15 |
| webmail.themebreaker.wordpress.netmail | In scope | 2026-11-15 |
| webmail.themecrafter.wordpress.netmail | In scope | 2026-11-15 |
| webmail.sparklemotion.wordpress.netmail | In scope | 2026-11-15 |
| webmail.forums.malaysia.wordpress.netmail | In scope | 2026-11-15 |
| webmail.mt-export-split.wordpress.netmail | In scope | 2026-11-15 |
| mail1.bloodclotawareness.wordpress.netmail | In scope | 2026-11-15 |
| autodiscover.install4free.wordpress.netmail | In scope | 2026-11-15 |
| webmail.download.malaysia.wordpress.netmail | In scope | 2026-11-15 |
| autodiscover.sparklemotion.wordpress.netmail | In scope | 2026-11-15 |
| webmail.2u35.cowebmail.2017.wordpress.netmail | In scope | 2026-11-15 |
29,002 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.