Stored XSS in WordPress #276105 Informative Cross-site Scripting – 2018-02-02 – 3 antispambot does not always escape <, >, &, " and ' #298218 Informative Cross-site Scripting – 2019-09-16 – 3 Stored but [SELF] XSS in mercantile.wordpress.org #222224 Valid Cross-site Scripting – 2017-05-26 – 8 Self-XSS in WordPress Editor Link Modal #224556 Valid Cross-site Scripting – 2017-11-08 – 8 MediaElements XSS #299112 Valid Cross-site Scripting – 2018-02-15 – 9 XSS on support.wordcamp.org in ajax-quote.php #355773 Valid Cross-site Scripting – 2018-07-23 – 9 Stored XSS on Wordpress 5.3 via Title Post #754352 N/A Cross-site Scripting – 2019-12-10 – 9 xss - reflected #384112 Valid Cross-site Scripting – 2018-07-24 – 10 Lack of Sanitization and Insufficient Authentication #249759 Valid Cross-site Scripting – 2017-12-26 – 11 Stored xss via template injection #250837 Valid Cross-site Scripting – 2017-12-11 – 12 pre-auth Stored XSS in comments via javascript: url when administrator edits user supplied comment #633231 Valid Cross-site Scripting – 2020-08-18 – 12 [mercantile.wordpress.org] Reflected XSS #240256 Valid Cross-site Scripting – 2018-08-30 – 13 Stored XSS in Post Preview as Contributor #497724 Valid Cross-site Scripting – 2020-08-18 – 14 Authenticated Cross-site Scripting in Template Name #220903 Valid Cross-site Scripting – 2017-11-18 – 15 Stored self-XSS in mercantile.wordpress.org checkout #230232 Valid Cross-site Scripting – 2017-07-14 – 15 Reflected XSS: Taxonomy Converter via tax parameter #495515 Valid Cross-site Scripting – 2019-08-28 – 15 Reflected XSS at https://da.wordpress.org/themes/?s= via "s=" parameter #222040 Valid Cross-site Scripting – 2017-07-26 – 16 XSS in the search bar of mercantile.wordpress.org #221893 Valid Cross-site Scripting – 2017-05-20 – 19 [FG-VD-18-165] Wordpress Cross-Site Scripting Vulnerability Notification II #460911 Valid Cross-site Scripting – 2019-10-11 – 20 Large-site Quick Edit reparses a Contributor display name into active HTML #3878399 Valid Cross-site Scripting Medium 2026-10-21 – 20 DOM Based XSS In mercantile.wordpress.org #230435 Valid Cross-site Scripting – 2017-06-14 – 21 XSS via unicode characters in upload filename #179695 Valid Cross-site Scripting – 2020-08-28 – 23 Wordpress 4.7.2 - Two XSS in Media Upload when file too large. #203515 Valid Cross-site Scripting – 2017-07-17 – 23 Stored XSS on Broken Themes via filename #406289 Valid Cross-site Scripting – 2020-08-25 – 23 Authenticated Stored Cross-site Scripting in bbPress #881918 Valid Cross-site Scripting – 2020-06-29 – 24 [mercantile.wordpress.org] Reflected XSS via AngularJS Template Injection #230234 Valid Cross-site Scripting – 2017-06-14 – 29 Author → stored XSS in wp-admin: unescaped sub-size filename from attachment metadata breaks out of the `src` attribute in `get_media_item()` #3931771 Valid Cross-site Scripting Critical 2026-08-28 – 32 "Bad Protocols Validation" Bypass in "wp_kses_bad_protocol_once" using HTML-encoding without trailing semicolons #339483 Valid Cross-site Scripting – 2019-11-16 – 34 Multiple stored XSS in WordPress #221507 Valid Cross-site Scripting – 2018-11-16 – 35 wp-embed XSS on Safari #1238528 Valid Cross-site Scripting – 2023-07-01 – 49 Potential unprivileged Stored XSS through wp_targeted_link_rel #509930 Valid Cross-site Scripting – 2020-01-08 – 80 Reflected XSS on https://make.wordpress.org via 'channel' parameter #659419 Valid Cross-site Scripting – 2019-08-26 – 97 Stored XSS on byddypress Plug-in via groups name Analysed #592316 Valid Cross-site Scripting – 2019-07-27 – 132 Stored XSS in Private Message component (BuddyPress) Analysed #487081 Valid Cross-site Scripting – 2019-03-08 – 337 Stored XSS Vulnerability Analysed #643908 Valid Cross-site Scripting – 2019-07-18 – 403