Skip to content
Connect AISign inSign up free

Bug bounty program

WO

WordPress

Open on HackerOneAtlas
Platform
HackerOne
Bounties
Pays
Assets in scope
23
Disclosed reports
96
Subdomains
29,502
Vendor on CyberSIXT
WordPress (405 CVEs, 7 exploited)

Most upvoted reports96

All reports
Most upvoted reports of WordPress
ReportWeaknessDisclosedBountyVotes
Stored XSS VulnerabilityAnalysed#643908Cross-site Scripting2019-07-18–403
Stored XSS in Private Message component (BuddyPress)Analysed#487081Cross-site Scripting2019-03-08–337
RCE as Admin defeats WordPress hardening and file permissionsAnalysed#436928File and Path Handling2020-06-09–164
Stored XSS on byddypress Plug-in via groups nameAnalysed#592316Cross-site Scripting2019-07-27–132
Wordpress unzip_file path traversalAnalysed#205481Misconfiguration and Insecure Design2020-01-29–119
Reflected XSS on https://make.wordpress.org via 'channel' parameterAnalysed#659419Cross-site Scripting2019-08-26–97
CSRF to HTML Injection in CommentsAnalysed#428019Cross-Site Request Forgery2019-05-13–95
Privilege Escalation via REST API to Administrator leads to RCEAnalysed#1107282Access Control2021-05-17–92
Clickjacking on donation pageAnalysed#921709Misconfiguration and Insecure Design2020-07-16–90
Potential unprivileged Stored XSS through wp_targeted_link_relAnalysed#509930Cross-site Scripting2020-01-08–80

Subdomains29,502

Root
Scope:In scope
Name suggests:Data and files
First seen
Text fileClear filters149+ names
Subdomains of WordPress
NameScopeFirst seen
db.codex.buddypress.orgdataIn scope2026-11-15
elastic.codex.buddypress.orgdataIn scope2026-11-15
ftp.codex.buddypress.orgdataIn scope2026-11-15
mongo.codex.buddypress.orgdataIn scope2026-11-15
mongodb.codex.buddypress.orgdataIn scope2026-11-15
mysql.codex.buddypress.orgdataIn scope2026-11-15
upload.codex.buddypress.orgdataIn scope2026-11-15
db.buddypress.orgdataIn scope2026-11-15
elastic.buddypress.orgdataIn scope2026-11-15
ftp.buddypress.orgdataIn scope2026-11-15
mongo.buddypress.orgdataIn scope2026-11-15
mongodb.buddypress.orgdataIn scope2026-11-15
mysql.buddypress.orgdataIn scope2026-11-15
upload.buddypress.orgdataIn scope2026-11-15
db.wordcamp.orgdataIn scope2026-11-15
elastic.wordcamp.orgdataIn scope2026-11-15
ftp.wordcamp.orgdataIn scope2026-11-15
mongo.wordcamp.orgdataIn scope2026-11-15
mongodb.wordcamp.orgdataIn scope2026-11-15
mysql.wordcamp.orgdataIn scope2026-11-15
upload.wordcamp.orgdataIn scope2026-11-15
ftp.2017.wordpress.netdataIn scope2026-11-15
ftp.2019.wordpress.netdataIn scope2026-11-15
db.wordpress.netdataIn scope2026-11-15
elastic.wordpress.netdataIn scope2026-11-15
files.wordpress.netdataIn scope2026-11-15
meritline.files.wordpress.netdataIn scope2026-11-15
quynhhop.files.wordpress.netdataIn scope2026-11-15
schenectadylandlords.files.wordpress.netdataIn scope2026-11-15
ftp.wordpress.netdataIn scope2026-11-15
ftp.gt.wordpress.netdataIn scope2026-11-15
mongo.wordpress.netdataIn scope2026-11-15
mongodb.wordpress.netdataIn scope2026-11-15
mysql.wordpress.netdataIn scope2026-11-15
ftp.redirect.wordpress.netdataIn scope2026-11-15
ftp.sparklemotion.wordpress.netdataIn scope2026-11-15
ftp.themecrafter.wordpress.netdataIn scope2026-11-15
upload.wordpress.netdataIn scope2026-11-15
ftp.wp10.wordpress.netdataIn scope2026-11-15
ftp.wp15.wordpress.netdataIn scope2026-11-15
backup.wordpress.orgdataIn scope2026-11-15
www.backup.wordpress.orgdataIn scope2026-11-15
backup01.wordpress.orgdataIn scope2026-11-15
backup02.wordpress.orgdataIn scope2026-11-15
backup1.wordpress.orgdataIn scope2026-11-15
backup2.wordpress.orgdataIn scope2026-11-15
backup3.wordpress.orgdataIn scope2026-11-15
backup4.wordpress.orgdataIn scope2026-11-15
backup5.wordpress.orgdataIn scope2026-11-15
backup6.wordpress.orgdataIn scope2026-11-15
backups.wordpress.orgdataIn scope2026-11-15
ftp.blog.wordpress.orgdataIn scope2026-11-15
ftp.cp.wordpress.orgdataIn scope2026-11-15
database.wordpress.orgdataIn scope2026-11-15
database1.wordpress.orgdataIn scope2026-11-15
database2.wordpress.orgdataIn scope2026-11-15
db.wordpress.orgdataIn scope2026-11-15
www.db.wordpress.orgdataIn scope2026-11-15
elastic.de.wordpress.orgdataIn scope2026-11-15
ftp.de.wordpress.orgdataIn scope2026-11-15
mongo.de.wordpress.orgdataIn scope2026-11-15
mongodb.de.wordpress.orgdataIn scope2026-11-15
mysql.de.wordpress.orgdataIn scope2026-11-15
upload.de.wordpress.orgdataIn scope2026-11-15
ftp.demo.wordpress.orgdata, testIn scope2026-11-15
elastic.wordpress.orgdataIn scope2026-11-15
ftp.es.wordpress.orgdataIn scope2026-11-15
mysql.es.wordpress.orgdataIn scope2026-11-15
files.wordpress.orgdataIn scope2026-11-15
ashamumbai.files.wordpress.orgdataIn scope2026-11-15
autoconfig.files.wordpress.orgdataIn scope2026-11-15
autodiscover.files.wordpress.orgdata, mailIn scope2026-11-15
pilotfish.files.wordpress.orgdataIn scope2026-11-15
saritavasaconsulting.files.wordpress.orgdataIn scope2026-11-15
webdisk.files.wordpress.orgdataIn scope2026-11-15
www.files.wordpress.orgdataIn scope2026-11-15
files1.wordpress.orgdataIn scope2026-11-15
files2.wordpress.orgdataIn scope2026-11-15
files3.wordpress.orgdataIn scope2026-11-15
files4.wordpress.orgdataIn scope2026-11-15
ftp.forum.wordpress.orgdataIn scope2026-11-15
ftp.wordpress.orgdataIn scope2026-11-15
ftp-eu.wordpress.orgdataIn scope2026-11-15
www.ftp.wordpress.orgdataIn scope2026-11-15
ftp01.wordpress.orgdataIn scope2026-11-15
ftp02.wordpress.orgdataIn scope2026-11-15
ftp1.wordpress.orgdataIn scope2026-11-15
ftp10.wordpress.orgdataIn scope2026-11-15
ftp12.wordpress.orgdataIn scope2026-11-15
ftp13.wordpress.orgdataIn scope2026-11-15
ftp14.wordpress.orgdataIn scope2026-11-15
ftp15.wordpress.orgdataIn scope2026-11-15
ftp2.wordpress.orgdataIn scope2026-11-15
ftp3.wordpress.orgdataIn scope2026-11-15
ftp4.wordpress.orgdataIn scope2026-11-15
ftp5.wordpress.orgdataIn scope2026-11-15
ftp6.wordpress.orgdataIn scope2026-11-15
ftp7.wordpress.orgdataIn scope2026-11-15
ftp8.wordpress.orgdataIn scope2026-11-15
ftp9.wordpress.orgdataIn scope2026-11-15

29,002 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.

CyberSIXTSignal over noise
Sign inSign up free

Updated