Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Open API For Username enumeration#385322 | N/A | No weakness recorded | Low | 2018-07-23 | – | 25 |
| Reflected Swf XSS In ( plugins.svn.wordpress.org )#270060 | Valid | No weakness recorded | Medium | 2018-09-27 | – | 21 |
| Buddypress 2.9.1 - Exceeding the maximum upload size - XSS leading to potential RCE.#263109 | Valid | No weakness recorded | Medium | 2017-11-02 | – | 14 |
| code.wordpress.net subdomain Takeover#295330 | Valid | No weakness recorded | Medium | 2018-03-11 | – | 9 |
| [Buddypress] Arbitrary File Deletion through bp_avatar_set#183568 | Valid | No weakness recorded | High | 2017-08-22 | – | 9 |
| Lack of Password Confirmation when Changing Password and Email#224214 | Duplicate | No weakness recorded | – | 2017-04-28 | – | 7 |
| Privilege Escalation in BuddyPress core allows Moderate to Administrator#837018 | Valid | No weakness recorded | Medium | 2020-05-22 | – | 6 |
| Wordpress 4.8.1 - Rogue editor leads to RCE. And the risks of same origin frame scripting in general#263718 | Informative | No weakness recorded | High | 2017-10-04 | – | 4 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (2,699 analysed so far), which can be wrong. Data as of 2026-11-15.