Bug bounty program
WO
WordPress
Most upvoted reports96
All reports| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| Stored XSS VulnerabilityAnalysed#643908 | Cross-site Scripting | 2019-07-18 | – | 403 |
| Stored XSS in Private Message component (BuddyPress)Analysed#487081 | Cross-site Scripting | 2019-03-08 | – | 337 |
| RCE as Admin defeats WordPress hardening and file permissionsAnalysed#436928 | File and Path Handling | 2020-06-09 | – | 164 |
| Stored XSS on byddypress Plug-in via groups nameAnalysed#592316 | Cross-site Scripting | 2019-07-27 | – | 132 |
| Wordpress unzip_file path traversalAnalysed#205481 | Misconfiguration and Insecure Design | 2020-01-29 | – | 119 |
| Reflected XSS on https://make.wordpress.org via 'channel' parameterAnalysed#659419 | Cross-site Scripting | 2019-08-26 | – | 97 |
| CSRF to HTML Injection in CommentsAnalysed#428019 | Cross-Site Request Forgery | 2019-05-13 | – | 95 |
| Privilege Escalation via REST API to Administrator leads to RCEAnalysed#1107282 | Access Control | 2021-05-17 | – | 92 |
| Clickjacking on donation pageAnalysed#921709 | Misconfiguration and Insecure Design | 2020-07-16 | – | 90 |
| Potential unprivileged Stored XSS through wp_targeted_link_relAnalysed#509930 | Cross-site Scripting | 2020-01-08 | – | 80 |
Subdomains29,502
| Name | Scope | First seen |
|---|---|---|
| basic-nodejs-dev.buddypress.orgdev | In scope | 2026-11-15 |
| cim-api-dev.buddypress.orgapi, dev | In scope | 2026-11-15 |
| cim-dev.buddypress.orgdev | In scope | 2026-11-15 |
| cim-geo-dev.buddypress.orgdev | In scope | 2026-11-15 |
| basic-nodejs-dev.codex.buddypress.orgdev | In scope | 2026-11-15 |
| cim-api-dev.codex.buddypress.orgapi, dev | In scope | 2026-11-15 |
| cim-dev.codex.buddypress.orgdev | In scope | 2026-11-15 |
| cim-geo-dev.codex.buddypress.orgdev | In scope | 2026-11-15 |
| dev.codex.buddypress.orgdev | In scope | 2026-11-15 |
| gcom-product-find-dev.codex.buddypress.orgdev | In scope | 2026-11-15 |
| gws-dev.codex.buddypress.orgdev | In scope | 2026-11-15 |
| localhost.codex.buddypress.orgdev | In scope | 2026-11-15 |
| nodejs-dev.codex.buddypress.orgdev | In scope | 2026-11-15 |
| searchportal-dev.codex.buddypress.orgdev | In scope | 2026-11-15 |
| dev.buddypress.orgdev | In scope | 2026-11-15 |
| dogfood-dev.buddypress.orgdev | In scope | 2026-11-15 |
| gcom-product-find-dev.buddypress.orgdev | In scope | 2026-11-15 |
| gws-dev.buddypress.orgdev | In scope | 2026-11-15 |
| localhost.buddypress.orgdev | In scope | 2026-11-15 |
| nodejs-dev.buddypress.orgdev | In scope | 2026-11-15 |
| searchportal-dev.buddypress.orgdev | In scope | 2026-11-15 |
| 2010dev.wordcamp.orgdev | In scope | 2026-11-15 |
| basic-nodejs-dev.wordcamp.orgdev | In scope | 2026-11-15 |
| cim-api-dev.wordcamp.orgapi, dev | In scope | 2026-11-15 |
| cim-dev.wordcamp.orgdev | In scope | 2026-11-15 |
| cim-geo-dev.wordcamp.orgdev | In scope | 2026-11-15 |
| dev.wordcamp.orgdev | In scope | 2026-11-15 |
| wclx12.dev.wordcamp.orgdev | In scope | 2026-11-15 |
| dogfood-dev.wordcamp.orgdev | In scope | 2026-11-15 |
| gcom-product-find-dev.wordcamp.orgdev | In scope | 2026-11-15 |
| gws-dev.wordcamp.orgdev | In scope | 2026-11-15 |
| local.la.wordcamp.orgdev | In scope | 2026-11-15 |
| localhost.wordcamp.orgdev | In scope | 2026-11-15 |
| nodejs-dev.wordcamp.orgdev | In scope | 2026-11-15 |
| searchportal-dev.wordcamp.orgdev | In scope | 2026-11-15 |
| 2012-dev.toronto.wordcamp.orgdev | In scope | 2026-11-15 |
| wcsf2010dev.wordcamp.orgdev | In scope | 2026-11-15 |
| wcsf2011-dev.wordcamp.orgdev | In scope | 2026-11-15 |
| basic-nodejs-dev.wordpress.netdev | In scope | 2026-11-15 |
| cim-geo-dev.wordpress.netdev | In scope | 2026-11-15 |
| dev.wordpress.netdev | In scope | 2026-11-15 |
| dogfood-dev.wordpress.netdev | In scope | 2026-11-15 |
| gcom-product-find-dev.wordpress.netdev | In scope | 2026-11-15 |
| gws-dev.wordpress.netdev | In scope | 2026-11-15 |
| localhost.wordpress.netdev | In scope | 2026-11-15 |
| searchportal-dev.wordpress.netdev | In scope | 2026-11-15 |
| dev.admin.wordpress.orgadmin, dev | In scope | 2026-11-15 |
| dev.android.wordpress.orgdev | In scope | 2026-11-15 |
| api-dev.wordpress.orgapi, dev | In scope | 2026-11-15 |
| basic-nodejs-dev.wordpress.orgdev | In scope | 2026-11-15 |
| dev.blackberry.wordpress.orgdev | In scope | 2026-11-15 |
| blog-dev.wordpress.orgdev | In scope | 2026-11-15 |
| localhost.blog.wordpress.orgdev | In scope | 2026-11-15 |
| cim-api-dev.wordpress.orgapi, dev | In scope | 2026-11-15 |
| cim-dev.wordpress.orgdev | In scope | 2026-11-15 |
| cim-geo-dev.wordpress.orgdev | In scope | 2026-11-15 |
| crm-dev.wordpress.orgdev | In scope | 2026-11-15 |
| dev.de.wordpress.orgdev | In scope | 2026-11-15 |
| localhost.de.wordpress.orgdev | In scope | 2026-11-15 |
| dev.wordpress.orgdev | In scope | 2026-11-15 |
| dev-admin.wordpress.orgadmin, dev | In scope | 2026-11-15 |
| dev-api.wordpress.orgapi, dev | In scope | 2026-11-15 |
| dev-www.wordpress.orgdev | In scope | 2026-11-15 |
| dev0.wordpress.orgdev | In scope | 2026-11-15 |
| dev01.wordpress.orgdev | In scope | 2026-11-15 |
| dev02.wordpress.orgdev | In scope | 2026-11-15 |
| dev1.wordpress.orgdev | In scope | 2026-11-15 |
| dev10.wordpress.orgdev | In scope | 2026-11-15 |
| dev2.wordpress.orgdev | In scope | 2026-11-15 |
| autoconfig.dev2.wordpress.orgdev | In scope | 2026-11-15 |
| autodiscover.dev2.wordpress.orgdev, mail | In scope | 2026-11-15 |
| webdisk.dev2.wordpress.orgdev | In scope | 2026-11-15 |
| www.dev2.wordpress.orgdev | In scope | 2026-11-15 |
| dev3.wordpress.orgdev | In scope | 2026-11-15 |
| www.dev3.wordpress.orgdev | In scope | 2026-11-15 |
| dev4.wordpress.orgdev | In scope | 2026-11-15 |
| dev5.wordpress.orgdev | In scope | 2026-11-15 |
| dev6.wordpress.orgdev | In scope | 2026-11-15 |
| dev7.wordpress.orgdev | In scope | 2026-11-15 |
| devel.wordpress.orgdev | In scope | 2026-11-15 |
| www.devel.wordpress.orgdev | In scope | 2026-11-15 |
| devel2.wordpress.orgdev | In scope | 2026-11-15 |
| develop.wordpress.orgdev | In scope | 2026-11-15 |
| www.develop.wordpress.orgdev | In scope | 2026-11-15 |
| development.wordpress.orgdev | In scope | 2026-11-15 |
| webdisk.development.wordpress.orgdev | In scope | 2026-11-15 |
| www.development.wordpress.orgdev | In scope | 2026-11-15 |
| development4thepeople.wordpress.orgdev | In scope | 2026-11-15 |
| dogfood-dev.wordpress.orgdev | In scope | 2026-11-15 |
| dev.es.wordpress.orgdev | In scope | 2026-11-15 |
| localhost.es.wordpress.orgdev | In scope | 2026-11-15 |
| gcom-product-find-dev.wordpress.orgdev | In scope | 2026-11-15 |
| develop.git.wordpress.orgdev, git | In scope | 2026-11-15 |
| gws-dev.wordpress.orgdev | In scope | 2026-11-15 |
| dev.ios.wordpress.orgdev | In scope | 2026-11-15 |
| local.wordpress.orgdev | In scope | 2026-11-15 |
| www.local.wordpress.orgdev | In scope | 2026-11-15 |
| localhost.wordpress.orgdev | In scope | 2026-11-15 |
| m-dev.wordpress.orgdev | In scope | 2026-11-15 |
| dev.m.wordpress.orgdev | In scope | 2026-11-15 |
29,002 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.