Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Stored XSS VulnerabilityAnalysed#643908 | Valid | Cross-site Scripting | High | 2019-07-18 | – | 403 |
| Stored XSS in Private Message component (BuddyPress)Analysed#487081 | Valid | Cross-site Scripting | Critical | 2019-03-08 | – | 337 |
| Stored XSS on byddypress Plug-in via groups nameAnalysed#592316 | Valid | Cross-site Scripting | Low | 2019-07-27 | – | 132 |
| Reflected XSS on https://make.wordpress.org via 'channel' parameterAnalysed#659419 | Valid | Cross-site Scripting | High | 2019-08-26 | – | 97 |
| Potential unprivileged Stored XSS through wp_targeted_link_relAnalysed#509930 | Valid | Cross-site Scripting | High | 2020-01-08 | – | 80 |
| wp-embed XSS on SafariAnalysed#1238528 | Valid | Cross-site Scripting | Medium | 2023-07-01 | – | 49 |
| Multiple stored XSS in WordPressAnalysed#221507 | Valid | Cross-site Scripting | – | 2018-11-16 | – | 35 |
| "Bad Protocols Validation" Bypass in "wp_kses_bad_protocol_once" using HTML-encoding without trailing semicolonsAnalysed#339483 | Valid | Cross-site Scripting | Medium | 2019-11-16 | – | 34 |
| Author → stored XSS in wp-admin: unescaped sub-size filename from attachment metadata breaks out of the `src` attribute in `get_media_item()`Analysed#3931771 | Valid | Cross-site Scripting | Critical | 2026-08-28 | – | 32 |
| [mercantile.wordpress.org] Reflected XSS via AngularJS Template InjectionAnalysed#230234 | Valid | Cross-site Scripting | Medium | 2017-06-14 | – | 29 |
| Authenticated Stored Cross-site Scripting in bbPressAnalysed#881918 | Valid | Cross-site Scripting | Medium | 2020-06-29 | – | 24 |
| Stored XSS on Broken Themes via filenameAnalysed#406289 | Valid | Cross-site Scripting | Low | 2020-08-25 | – | 23 |
| Wordpress 4.7.2 - Two XSS in Media Upload when file too large.Analysed#203515 | Valid | Cross-site Scripting | High | 2017-07-17 | – | 23 |
| XSS via unicode characters in upload filenameAnalysed#179695 | Valid | Cross-site Scripting | Medium | 2020-08-28 | – | 23 |
| DOM Based XSS In mercantile.wordpress.orgAnalysed#230435 | Valid | Cross-site Scripting | Medium | 2017-06-14 | – | 21 |
| Large-site Quick Edit reparses a Contributor display name into active HTMLAnalysed#3878399 | Valid | Cross-site Scripting | Medium | 2026-10-21 | – | 20 |
| [FG-VD-18-165] Wordpress Cross-Site Scripting Vulnerability Notification IIAnalysed#460911 | Valid | Cross-site Scripting | Medium | 2019-10-11 | – | 20 |
| XSS in the search bar of mercantile.wordpress.orgAnalysed#221893 | Valid | Cross-site Scripting | Medium | 2017-05-20 | – | 19 |
| Reflected XSS at https://da.wordpress.org/themes/?s= via "s=" parameter#222040 | Valid | Cross-site Scripting | Medium | 2017-07-26 | – | 16 |
| Reflected XSS: Taxonomy Converter via tax parameter#495515 | Valid | Cross-site Scripting | Medium | 2019-08-28 | – | 15 |
| Stored self-XSS in mercantile.wordpress.org checkout#230232 | Valid | Cross-site Scripting | Low | 2017-07-14 | – | 15 |
| Authenticated Cross-site Scripting in Template Name#220903 | Valid | Cross-site Scripting | Medium | 2017-11-18 | – | 15 |
| Stored XSS in Post Preview as Contributor#497724 | Valid | Cross-site Scripting | Medium | 2020-08-18 | – | 14 |
| [mercantile.wordpress.org] Reflected XSS#240256 | Valid | Cross-site Scripting | Medium | 2018-08-30 | – | 13 |
| pre-auth Stored XSS in comments via javascript: url when administrator edits user supplied comment#633231 | Valid | Cross-site Scripting | High | 2020-08-18 | – | 12 |
| Stored xss via template injection#250837 | Valid | Cross-site Scripting | High | 2017-12-11 | – | 12 |
| Lack of Sanitization and Insufficient Authentication#249759 | Valid | Cross-site Scripting | Medium | 2017-12-26 | – | 11 |
| xss - reflected#384112 | Valid | Cross-site Scripting | Low | 2018-07-24 | – | 10 |
| XSS on support.wordcamp.org in ajax-quote.php#355773 | Valid | Cross-site Scripting | – | 2018-07-23 | – | 9 |
| MediaElements XSS#299112 | Valid | Cross-site Scripting | High | 2018-02-15 | – | 9 |
| Self-XSS in WordPress Editor Link Modal#224556 | Valid | Cross-site Scripting | Low | 2017-11-08 | – | 8 |
| Stored but [SELF] XSS in mercantile.wordpress.org#222224 | Valid | Cross-site Scripting | Low | 2017-05-26 | – | 8 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,614 analysed so far), which can be wrong. Data as of 2026-11-15.