Bug bounty program
WO
WordPress
Most upvoted reports96
All reports| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| Stored XSS VulnerabilityAnalysed#643908 | Cross-site Scripting | 2019-07-18 | – | 403 |
| Stored XSS in Private Message component (BuddyPress)Analysed#487081 | Cross-site Scripting | 2019-03-08 | – | 337 |
| RCE as Admin defeats WordPress hardening and file permissionsAnalysed#436928 | File and Path Handling | 2020-06-09 | – | 164 |
| Stored XSS on byddypress Plug-in via groups nameAnalysed#592316 | Cross-site Scripting | 2019-07-27 | – | 132 |
| Wordpress unzip_file path traversalAnalysed#205481 | Misconfiguration and Insecure Design | 2020-01-29 | – | 119 |
| Reflected XSS on https://make.wordpress.org via 'channel' parameterAnalysed#659419 | Cross-site Scripting | 2019-08-26 | – | 97 |
| CSRF to HTML Injection in CommentsAnalysed#428019 | Cross-Site Request Forgery | 2019-05-13 | – | 95 |
| Privilege Escalation via REST API to Administrator leads to RCEAnalysed#1107282 | Access Control | 2021-05-17 | – | 92 |
| Clickjacking on donation pageAnalysed#921709 | Misconfiguration and Insecure Design | 2020-07-16 | – | 90 |
| Potential unprivileged Stored XSS through wp_targeted_link_relAnalysed#509930 | Cross-site Scripting | 2020-01-08 | – | 80 |
Subdomains29,502
| Name | Scope | First seen |
|---|---|---|
| 20.bbpress.org | Not in the scope | 2026-11-15 |
| 253acodex.bbpress.org | Not in the scope | 2026-11-15 |
| 3acodex.bbpress.org | Not in the scope | 2026-11-15 |
| _cisco-uds.bbpress.org | Not in the scope | 2026-11-15 |
| _collab-edge.bbpress.org | Not in the scope | 2026-11-15 |
| _cuplogin.bbpress.org | Not in the scope | 2026-11-15 |
| _dmarc.bbpress.org | Not in the scope | 2026-11-15 |
| _etcd-server-ssl.bbpress.org | Not in the scope | 2026-11-15 |
| _mta-sts.bbpress.org | Not in the scope | 2026-11-15 |
| _tcp.bbpress.org | Not in the scope | 2026-11-15 |
| _cisco-uds._tcp.bbpress.org | Not in the scope | 2026-11-15 |
| _cuplogin._tcp.bbpress.org | Not in the scope | 2026-11-15 |
| _tls.bbpress.org | Not in the scope | 2026-11-15 |
| _collab-edge._tls.bbpress.org | Not in the scope | 2026-11-15 |
| a.bbpress.org | Not in the scope | 2026-11-15 |
| acapi.bbpress.org | Not in the scope | 2026-11-15 |
| admin.bbpress.orgadmin | Not in the scope | 2026-11-15 |
| akamai.bbpress.org | Not in the scope | 2026-11-15 |
| akamai-test.bbpress.orgtest | Not in the scope | 2026-11-15 |
| akamai-test-origin.bbpress.orgtest | Not in the scope | 2026-11-15 |
| api.bbpress.orgapi | Not in the scope | 2026-11-15 |
| app.bbpress.org | Not in the scope | 2026-11-15 |
| assets.bbpress.org | Not in the scope | 2026-11-15 |
| auth.bbpress.orgauth | Not in the scope | 2026-11-15 |
| autoconfig.bbpress.org | Not in the scope | 2026-11-15 |
| autodiscover.bbpress.orgmail | Not in the scope | 2026-11-15 |
| awsdashboard.bbpress.org | Not in the scope | 2026-11-15 |
| b.bbpress.org | Not in the scope | 2026-11-15 |
| basic.bbpress.org | Not in the scope | 2026-11-15 |
| basic-nodejs-dev.bbpress.orgdev | Not in the scope | 2026-11-15 |
| bbs.bbpress.org | Not in the scope | 2026-11-15 |
| beta.bbpress.orgstaging | Not in the scope | 2026-11-15 |
| blog.bbpress.org | Not in the scope | 2026-11-15 |
| blogs.bbpress.org | Not in the scope | 2026-11-15 |
| builder.bbpress.org | Not in the scope | 2026-11-15 |
| c.bbpress.org | Not in the scope | 2026-11-15 |
| c13-b2b-prod-fa-web-lb.bbpress.org | Not in the scope | 2026-11-15 |
| careers.bbpress.org | Not in the scope | 2026-11-15 |
| cdn.bbpress.org | Not in the scope | 2026-11-15 |
| cdq-api.bbpress.orgapi | Not in the scope | 2026-11-15 |
| cert.bbpress.org | Not in the scope | 2026-11-15 |
| certificate.bbpress.org | Not in the scope | 2026-11-15 |
| check.bbpress.org | Not in the scope | 2026-11-15 |
| cim-api.bbpress.orgapi | Not in the scope | 2026-11-15 |
| cim-api-dev.bbpress.orgapi, dev | Not in the scope | 2026-11-15 |
| cim-api-qa.bbpress.orgapi, test | Not in the scope | 2026-11-15 |
| cim-api-uat.bbpress.orgapi, test | Not in the scope | 2026-11-15 |
| cim-data-quality-qa.bbpress.orgtest | Not in the scope | 2026-11-15 |
| cim-dev.bbpress.orgdev | Not in the scope | 2026-11-15 |
| cim-geo-dev.bbpress.orgdev | Not in the scope | 2026-11-15 |
| citrix.bbpress.orgvpn | Not in the scope | 2026-11-15 |
| click.bbpress.org | Not in the scope | 2026-11-15 |
| cname.bbpress.org | Not in the scope | 2026-11-15 |
| code.bbpress.org | Not in the scope | 2026-11-15 |
| _cisco-uds.codex.bbpress.org | Not in the scope | 2026-11-15 |
| _collab-edge.codex.bbpress.org | Not in the scope | 2026-11-15 |
| _cuplogin.codex.bbpress.org | Not in the scope | 2026-11-15 |
| _dmarc.codex.bbpress.org | Not in the scope | 2026-11-15 |
| _domainkey.codex.bbpress.org | Not in the scope | 2026-11-15 |
| _etcd-server-ssl.codex.bbpress.org | Not in the scope | 2026-11-15 |
| _mta-sts.codex.bbpress.org | Not in the scope | 2026-11-15 |
| _tcp.codex.bbpress.org | Not in the scope | 2026-11-15 |
| _cisco-uds._tcp.codex.bbpress.org | Not in the scope | 2026-11-15 |
| _cuplogin._tcp.codex.bbpress.org | Not in the scope | 2026-11-15 |
| _tls.codex.bbpress.org | Not in the scope | 2026-11-15 |
| _collab-edge._tls.codex.bbpress.org | Not in the scope | 2026-11-15 |
| a.codex.bbpress.org | Not in the scope | 2026-11-15 |
| acapi.codex.bbpress.org | Not in the scope | 2026-11-15 |
| admin.codex.bbpress.orgadmin | Not in the scope | 2026-11-15 |
| akamai.codex.bbpress.org | Not in the scope | 2026-11-15 |
| akamai-test.codex.bbpress.orgtest | Not in the scope | 2026-11-15 |
| akamai-test-origin.codex.bbpress.orgtest | Not in the scope | 2026-11-15 |
| api.codex.bbpress.orgapi | Not in the scope | 2026-11-15 |
| app.codex.bbpress.org | Not in the scope | 2026-11-15 |
| assets.codex.bbpress.org | Not in the scope | 2026-11-15 |
| auth.codex.bbpress.orgauth | Not in the scope | 2026-11-15 |
| autoconfig.codex.bbpress.org | Not in the scope | 2026-11-15 |
| autodiscover.codex.bbpress.orgmail | Not in the scope | 2026-11-15 |
| awsdashboard.codex.bbpress.org | Not in the scope | 2026-11-15 |
| b.codex.bbpress.org | Not in the scope | 2026-11-15 |
| basic.codex.bbpress.org | Not in the scope | 2026-11-15 |
| basic-nodejs-dev.codex.bbpress.orgdev | Not in the scope | 2026-11-15 |
| bbs.codex.bbpress.org | Not in the scope | 2026-11-15 |
| beta.codex.bbpress.orgstaging | Not in the scope | 2026-11-15 |
| blog.codex.bbpress.org | Not in the scope | 2026-11-15 |
| blogs.codex.bbpress.org | Not in the scope | 2026-11-15 |
| builder.codex.bbpress.org | Not in the scope | 2026-11-15 |
| c.codex.bbpress.org | Not in the scope | 2026-11-15 |
| careers.codex.bbpress.org | Not in the scope | 2026-11-15 |
| cdn.codex.bbpress.org | Not in the scope | 2026-11-15 |
| cdq-api.codex.bbpress.orgapi | Not in the scope | 2026-11-15 |
| cert.codex.bbpress.org | Not in the scope | 2026-11-15 |
| certificate.codex.bbpress.org | Not in the scope | 2026-11-15 |
| check.codex.bbpress.org | Not in the scope | 2026-11-15 |
| cim-api.codex.bbpress.orgapi | Not in the scope | 2026-11-15 |
| cim-api-dev.codex.bbpress.orgapi, dev | Not in the scope | 2026-11-15 |
| cim-api-qa.codex.bbpress.orgapi, test | Not in the scope | 2026-11-15 |
| cim-api-uat.codex.bbpress.orgapi, test | Not in the scope | 2026-11-15 |
| cim-data-quality-qa.codex.bbpress.orgtest | Not in the scope | 2026-11-15 |
| cim-dev.codex.bbpress.orgdev | Not in the scope | 2026-11-15 |
29,002 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.