CSRF in Profile Fields allows deleting any field in BuddyPress #836187 Valid Cross-Site Request Forgery – 2020-05-22 – 5 WordPress core - Denial of Service via Cross Site Request Forgery #153093 Valid Denial of Service – 2017-11-16 – 6 Unauthenticated hidden groups disclosure via Ajax groups search #282176 Valid Access Control – 2017-11-02 – 6 Privilege Escalation in BuddyPress core allows Moderate to Administrator #837018 Valid No weakness recorded – 2020-05-22 – 6 [BuddyPress 2.9.1] Open Redirect via "wp_http_referer" parameter on "bp-profile-edit" endpoint #277502 Valid Open Redirect – 2017-11-02 – 7 Stored but [SELF] XSS in mercantile.wordpress.org #222224 Valid Cross-site Scripting – 2017-05-26 – 8 Self-XSS in WordPress Editor Link Modal #224556 Valid Cross-site Scripting – 2017-11-08 – 8 Clickjacking - https://mercantile.wordpress.org/ #258283 Valid Misconfiguration and Insecure Design – 2017-08-28 – 8 Allow authenticated users can edit, trash,and add new in BuddyPress Emails function #833782 Valid Access Control – 2020-05-22 – 8 [Buddypress] Arbitrary File Deletion through bp_avatar_set #183568 Valid No weakness recorded – 2017-08-22 – 9 code.wordpress.net subdomain Takeover #295330 Valid No weakness recorded – 2018-03-11 – 9 MediaElements XSS #299112 Valid Cross-site Scripting – 2018-02-15 – 9 XSS on support.wordcamp.org in ajax-quote.php #355773 Valid Cross-site Scripting – 2018-07-23 – 9 xss - reflected #384112 Valid Cross-site Scripting – 2018-07-24 – 10 Lack of Sanitization and Insufficient Authentication #249759 Valid Cross-site Scripting – 2017-12-26 – 11 Stored xss via template injection #250837 Valid Cross-site Scripting – 2017-12-11 – 12 Clickjacking mercantile.wordpress.org #264125 Valid Misconfiguration and Insecure Design – 2017-09-08 – 12 [support.wordcamp.org] - publicly accessible .svn repository #309714 Valid Access Control – 2018-02-01 – 12 pre-auth Stored XSS in comments via javascript: url when administrator edits user supplied comment #633231 Valid Cross-site Scripting – 2020-08-18 – 12 Improper Access Control in Buddypress core allows reply,delete any user's activity #837256 Valid Access Control – 2020-05-22 – 12 Missing SSL can leak job token #222036 Valid Cryptography – 2017-11-01 – 13 [mercantile.wordpress.org] Reflected XSS #240256 Valid Cross-site Scripting – 2018-08-30 – 13 Clickjacking wordcamp.org #230581 Valid Misconfiguration and Insecure Design – 2017-06-24 – 14 Buddypress 2.9.1 - Exceeding the maximum upload size - XSS leading to potential RCE. #263109 Valid No weakness recorded – 2017-11-02 – 14 Open Redirect on the nl.wordpress.net #309058 Valid Open Redirect – 2018-02-22 – 14 Stored XSS in Post Preview as Contributor #497724 Valid Cross-site Scripting – 2020-08-18 – 14 CSRF to add admin [wordpress] #149589 Valid Cross-Site Request Forgery – 2017-06-30 – 15 Authenticated Cross-site Scripting in Template Name #220903 Valid Cross-site Scripting – 2017-11-18 – 15 Stored self-XSS in mercantile.wordpress.org checkout #230232 Valid Cross-site Scripting – 2017-07-14 – 15 Reflected XSS: Taxonomy Converter via tax parameter #495515 Valid Cross-site Scripting – 2019-08-28 – 15 Reflected XSS at https://da.wordpress.org/themes/?s= via "s=" parameter #222040 Valid Cross-site Scripting – 2017-07-26 – 16 Clickjacking In jobs.wordpress.net #223024 Valid Misconfiguration and Insecure Design – 2018-08-22 – 16 Unauthenticated private CSV export of Meetup organizer PII via broken authz check in WordCamp Reports #3871816 Valid Access Control High 2026-11-05 – 16 WordPress DB Class, bad implementation of prepare method guides to sqli and information disclosure #179920 Valid SQL Injection – 2017-11-13 – 17 Arbitrary file deletion in wp-core - guides towards RCE and information disclosure #291878 Valid File and Path Handling – 2018-08-29 – 17 PII of users can be downloaded from export pages #1172852 Valid Information Disclosure – 2023-05-12 – 17 Instamojo CampTix: fail-open MAC + webhook Credit without binding payment to order #3941626 Valid Access Control High 2026-11-05 – 17 XSS in the search bar of mercantile.wordpress.org #221893 Valid Cross-site Scripting – 2017-05-20 – 19 [FG-VD-18-165] Wordpress Cross-Site Scripting Vulnerability Notification II #460911 Valid Cross-site Scripting – 2019-10-11 – 20 Large-site Quick Edit reparses a Contributor display name into active HTML #3878399 Valid Cross-site Scripting Medium 2026-10-21 – 20 Wordpress 4.7 - CSRF -> HTTP SSRF any private ip:port and basic-auth #187520 Valid Cross-Site Request Forgery – 2017-11-20 – 21 Infrastructure - Photon - SSRF #204513 Valid Server-Side Request Forgery – 2017-07-17 – 21 DOM Based XSS In mercantile.wordpress.org #230435 Valid Cross-site Scripting – 2017-06-14 – 21 Reflected Swf XSS In ( plugins.svn.wordpress.org ) #270060 Valid No weakness recorded – 2018-09-27 – 21 Arbitrary change of blog's background image via CSRF #881855 Valid Cross-Site Request Forgery – 2020-12-14 – 21 Content Spoofing @ https://irclogs.wordpress.org/ #278151 Valid Access Control – 2017-12-04 – 22 XSS via unicode characters in upload filename #179695 Valid Cross-site Scripting – 2020-08-28 – 23 Wordpress 4.7.2 - Two XSS in Media Upload when file too large. #203515 Valid Cross-site Scripting – 2017-07-17 – 23 Stored XSS on Broken Themes via filename #406289 Valid Cross-site Scripting – 2020-08-25 – 23 Unauthenticated disclosure of private and hidden forum content in bbPress via the WordPress core REST single-item endpoint #3801107 Valid Access Control Critical 2026-10-12 – 23