Simplenote Silverlight cross-domain policy misconfiguration #7571 Valid Cross-Site Request Forgery – 2014-05-17 – 1 information disclosure #13939 Valid Information Disclosure – 2014-07-16 – 1 Open Redirect in WordPress Feed Statistics {Affected All Versions} #22142 Valid Open Redirect – 2014-08-07 – 1 CSV Injection in polldaddy.com #92353 Valid No weakness recorded – 2015-11-20 – 1 xss in simperium.com #13746 Valid Cross-site Scripting – 2014-08-10 – 2 XSS on gravatar #13794 Valid Cross-site Scripting – 2014-09-07 – 2 http://jetpack.me/ Self XSS #14303 Valid Cross-site Scripting – 2014-07-08 – 2 genericons.com - DOM based XSS. #14305 Valid Cross-site Scripting – 2014-07-08 – 2 Possible Timing Side-Channel in XMLRPC Verification #107296 Valid Cryptography – 2016-03-17 – 2 XSS at wordpress.com #111500 Valid Cross-site Scripting – 2016-02-18 – 2 xss in app.simplenote.com #13703 Valid Cross-site Scripting – 2014-07-08 – 3 XSS on codex.wordpress.org #104559 Valid Cross-site Scripting – 2016-06-19 – 3 Internal GET SSRF via CSRF with Press This scan feature #110801 Valid Cross-Site Request Forgery – 2016-03-04 – 3 XSS at www.woothemes.com #111365 Valid Cross-site Scripting – 2016-02-19 – 3 CPU utilization 99% on visiting wordpress site url & open redirect found #129091 Valid Open Redirect – 2017-07-23 – 3 Akismet Several CSRF vulnerabilities #131108 Valid Cross-Site Request Forgery – 2016-05-28 – 3 XSS on www.wordpress.com #133963 Valid Cross-site Scripting – 2016-04-28 – 3 https://polldaddy.com storage.swf XSS #9522 Valid Cross-site Scripting – 2014-07-08 – 4 logout csrf app.simplenote.com/logout #13705 Valid Cross-Site Request Forgery – 2014-07-08 – 4 XSS in WordPress #81736 Valid Cross-site Scripting – 2015-10-16 – 4 Remove anyone's pic gravtar #101145 Valid Authentication – 2016-06-05 – 4 XSS Vulnerability in WooCommerce Product Vendors plugin #253313 Valid Cross-site Scripting Low 2017-08-22 – 4 Verification code issues for Two-Step Authentication #67660 Valid Authentication – 2015-09-20 – 5 Persistent Cross-Site Scripting in WooCommerce WordPress plugin #152692 Valid Cross-site Scripting – 2017-11-16 – 6 De-anonymize anonymous tips through the Tumblr blog network #1484168 Valid Information Disclosure Medium 2022-02-21 – 6 Object Injection in Woocommerce / Handle PDT Responses from PayPal #245228 Valid No weakness recorded Medium 2017-09-11 – 7 Wordpress.com REST API oauth bypass via Cross Site Flashing #176308 Valid Cross-Site Request Forgery Medium 2018-04-26 – 8 privilege escalation #13959 Valid Authentication – 2014-08-10 – 9 Timing attack woocommerce, simplify commerce gateway #239359 Valid No weakness recorded Medium 2017-09-11 – 9 woocommerce - prevent_caching() bug / bypass #241323 Valid No weakness recorded Medium 2017-09-16 – 9 [public-api.wordpress.com] Stored XSS via Crafted Developer App Description #293743 Valid Cross-site Scripting Medium 2017-12-01 – 9 Theme Assets uploader allows HTML content #769998 Valid File and Path Handling Low 2020-01-14 – 9 Archived / Deleted / Private Poll Can Be Viewed by Another Users [Crowdsignal WordPress plugins] #1711318 Valid Access Control Low 2022-11-03 – 9 An Automattic employee's GitHub personal access token exposed in Travis CI build logs #218264 Valid Information Disclosure Medium 2017-06-06 – 10 Stored XSS Using Media #275386 Valid Cross-site Scripting Medium 2017-11-26 – 10 Remote Code Execution in Wordpress Desktop #301458 Valid Command and Code Injection Critical 2018-04-14 – 10 wpjobmanager - unserialize of user input #308489 Valid No weakness recorded Medium 2018-03-03 – 11 Follow by email allows for following by unverified emails #762121 Valid Misconfiguration and Insecure Design Low 2020-01-14 – 11 Permanent DoS at https://happy.tools/ when inviting a user #1041173 Valid Denial of Service Medium 2021-01-29 – 11 Site information's Display Name section vulnerable for XSS attacks and HTML Injections. #1554888 Valid Cross-site Scripting Low 2022-05-16 – 11 [bbPress] Stored XSS in any forum post. #151117 Valid Cross-site Scripting – 2016-09-01 – 12 Lazy Load stored XSS #152416 Valid Cross-site Scripting – 2017-12-01 – 12 Follow Button XSS #172574 Valid Cross-site Scripting – 2016-10-28 – 12 Modify account details by exploiting clickjacking vulnerability on refer.wordpress.com #765355 Valid Misconfiguration and Insecure Design Low 2020-02-22 – 12 Tab nabbing via window.opener.location (target "_blank") #984947 Valid Open Redirect – 2020-12-26 – 12 Stored XSS on the "www.intensedebate.com/extras-widgets" url at "Recent comments by" module with malicious blog url #1083734 Valid Cross-site Scripting Medium 2022-04-13 – 12 [sub.wordpress.com] - XSS when adjust block Poll - Confirmation Message - On submission:Redirect to another webpage - Redirect address:[xss_payload] #1050733 Valid Cross-site Scripting Medium 2021-02-11 – 13 Reflected XSS due to vulnerable version of sockjs #1100326 Valid Cross-site Scripting Medium 2022-04-29 – 13 Crafted frame injection leading to form-based UI redressing. #291683 Valid Misconfiguration and Insecure Design – 2017-12-31 – 14 Users can bypass page restrictions via Export feature at "Share" feature in CrowdSignal #915140 Valid No weakness recorded Medium 2020-11-18 – 14