Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Simplenote Silverlight cross-domain policy misconfiguration#7571 | Valid | Cross-Site Request Forgery | – | 2014-05-17 | – | 1 |
| Session Cookie without Secure flag set#7843 | Informative | No weakness recorded | – | 2014-05-21 | – | 1 |
| information disclosure#13939 | Valid | Information Disclosure | – | 2014-07-16 | – | 1 |
| Missing HSTS header in https://public-api.wordpress.com#20071 | Informative | Cryptography | – | 2014-08-28 | – | 1 |
| Open Redirect in WordPress Feed Statistics {Affected All Versions}#22142 | Valid | Open Redirect | – | 2014-08-07 | – | 1 |
| CSV Injection in polldaddy.com#92353 | Valid | No weakness recorded | – | 2015-11-20 | – | 1 |
| Session Cookie without Secure flag set#7680 | Informative | No weakness recorded | – | 2014-05-21 | – | 2 |
| xss in simperium.com#13746 | Valid | Cross-site Scripting | – | 2014-08-10 | – | 2 |
| XSS on gravatar#13794 | Valid | Cross-site Scripting | – | 2014-09-07 | – | 2 |
| http://jetpack.me/ Self XSS#14303 | Valid | Cross-site Scripting | – | 2014-07-08 | – | 2 |
| genericons.com - DOM based XSS.#14305 | Valid | Cross-site Scripting | – | 2014-07-08 | – | 2 |
| Serving Transitions From: HTTP Protocol (not secure)#14803 | Informative | Information Disclosure | – | 2014-06-04 | – | 2 |
| User Enumeration and Guessable User Account Attack on WORDPRESS#16439 | Informative | No weakness recorded | – | 2014-09-13 | – | 2 |
| Missing HSTS header in https://app.simplenote.com#20072 | Informative | Cryptography | – | 2014-08-16 | – | 2 |
| Possible Timing Side-Channel in XMLRPC Verification#107296 | Valid | Cryptography | – | 2016-03-17 | – | 2 |
| XSS at wordpress.com#111500 | Valid | Cross-site Scripting | – | 2016-02-18 | – | 2 |
| xss in app.simplenote.com#13703 | Valid | Cross-site Scripting | – | 2014-07-08 | – | 3 |
| Process of changing email address and password does not asks old Password.#15777 | Informative | Authentication | – | 2014-07-11 | – | 3 |
| XSS on codex.wordpress.org#104559 | Valid | Cross-site Scripting | – | 2016-06-19 | – | 3 |
| Internal GET SSRF via CSRF with Press This scan feature#110801 | Valid | Cross-Site Request Forgery | – | 2016-03-04 | – | 3 |
| XSS at www.woothemes.com#111365 | Valid | Cross-site Scripting | – | 2016-02-19 | – | 3 |
| CPU utilization 99% on visiting wordpress site url & open redirect found#129091 | Valid | Open Redirect | – | 2017-07-23 | – | 3 |
| Akismet Several CSRF vulnerabilities#131108 | Valid | Cross-Site Request Forgery | – | 2016-05-28 | – | 3 |
| XSS on www.wordpress.com#133963 | Valid | Cross-site Scripting | – | 2016-04-28 | – | 3 |
| HTML form without CSRF protection#7849 | Informative | Cross-Site Request Forgery | – | 2014-07-08 | – | 4 |
| https://polldaddy.com storage.swf XSS#9522 | Valid | Cross-site Scripting | – | 2014-07-08 | – | 4 |
| logout csrf app.simplenote.com/logout#13705 | Valid | Cross-Site Request Forgery | – | 2014-07-08 | – | 4 |
| Top 10 2013-A2-Broken Authentication and Session Management - wordpress.com#18503 | Informative | Authentication | – | 2014-08-16 | – | 4 |
| XSS in WordPress#81736 | Valid | Cross-site Scripting | – | 2015-10-16 | – | 4 |
| Remove anyone's pic gravtar#101145 | Valid | Authentication | – | 2016-06-05 | – | 4 |
| XSS Vulnerability in WooCommerce Product Vendors plugin#253313 | Valid | Cross-site Scripting | – | 2017-08-22 | – | 4 |
| Verification code issues for Two-Step Authentication#67660 | Valid | Authentication | – | 2015-09-20 | – | 5 |
| Persistent Cross-Site Scripting in WooCommerce WordPress plugin#152692 | Valid | Cross-site Scripting | – | 2017-11-16 | – | 6 |
| De-anonymize anonymous tips through the Tumblr blog network#1484168 | Valid | Information Disclosure | Medium | 2022-02-21 | – | 6 |
| Object Injection in Woocommerce / Handle PDT Responses from PayPal#245228 | Valid | No weakness recorded | – | 2017-09-11 | – | 7 |
| Wordpress.com REST API oauth bypass via Cross Site Flashing#176308 | Valid | Cross-Site Request Forgery | – | 2018-04-26 | – | 8 |
| Non-changing "_idnonce" value leads to CSRF on accounts at https://intensedebate.com for account takeover#1090982 | Informative | Cross-Site Request Forgery | – | 2021-02-17 | – | 8 |
| privilege escalation#13959 | Valid | Authentication | – | 2014-08-10 | – | 9 |
| Timing attack woocommerce, simplify commerce gateway#239359 | Valid | No weakness recorded | – | 2017-09-11 | – | 9 |
| woocommerce - prevent_caching() bug / bypass#241323 | Valid | No weakness recorded | – | 2017-09-16 | – | 9 |
| [public-api.wordpress.com] Stored XSS via Crafted Developer App Description#293743 | Valid | Cross-site Scripting | – | 2017-12-01 | – | 9 |
| Theme Assets uploader allows HTML content#769998 | Valid | File and Path Handling | – | 2020-01-14 | – | 9 |
| GET /api/v2/url_info endpoint is vulnerable to Blind SSRF#1057531 | Informative | Server-Side Request Forgery | – | 2020-12-15 | – | 9 |
| Archived / Deleted / Private Poll Can Be Viewed by Another Users [Crowdsignal WordPress plugins]#1711318 | Valid | Access Control | Low | 2022-11-03 | – | 9 |
| An Automattic employee's GitHub personal access token exposed in Travis CI build logs#218264 | Valid | Information Disclosure | – | 2017-06-06 | – | 10 |
| Stored XSS Using Media#275386 | Valid | Cross-site Scripting | – | 2017-11-26 | – | 10 |
| Remote Code Execution in Wordpress Desktop#301458 | Valid | Command and Code Injection | – | 2018-04-14 | – | 10 |
| Stored XSS in assets.txmblr.com#870703 | Informative | Cross-site Scripting | – | 2020-05-11 | – | 10 |
| wpjobmanager - unserialize of user input#308489 | Valid | No weakness recorded | – | 2018-03-03 | – | 11 |
| Follow by email allows for following by unverified emails#762121 | Valid | Misconfiguration and Insecure Design | – | 2020-01-14 | – | 11 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (779 analysed so far), which can be wrong. Data as of 2026-11-14.