Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
CSRF in Profile Fields allows deleting any field in BuddyPress#836187	Valid	Cross-Site Request Forgery	–	2020-05-22	–	5
CSRF on comment post#914232	N/A	Cross-Site Request Forgery	–	2020-07-16	–	5
Privilege Escalation in BuddyPress core allows Moderate to Administrator#837018	Valid	No weakness recorded	–	2020-05-22	–	6
Allow authenticated users can edit, trash,and add new in BuddyPress Emails function#833782	Valid	Access Control	–	2020-05-22	–	8
pre-auth Stored XSS in comments via javascript: url when administrator edits user supplied comment#633231	Valid	Cross-site Scripting	–	2020-08-18	–	12
Improper Access Control in Buddypress core allows reply,delete any user's activity#837256	Valid	Access Control	–	2020-05-22	–	12
Stored XSS in Post Preview as Contributor#497724	Valid	Cross-site Scripting	–	2020-08-18	–	14
Arbitrary change of blog's background image via CSRF#881855	Valid	Cross-Site Request Forgery	–	2020-12-14	–	21
XSS via unicode characters in upload filename#179695	Valid	Cross-site Scripting	–	2020-08-28	–	23
Stored XSS on Broken Themes via filename#406289	Valid	Cross-site Scripting	–	2020-08-25	–	23
Authenticated Stored Cross-site Scripting in bbPress#881918	Valid	Cross-site Scripting	–	2020-06-29	–	24
Potential unprivileged Stored XSS through wp_targeted_link_rel#509930	Valid	Cross-site Scripting	–	2020-01-08	–	80
Clickjacking on donation page#921709	Valid	Misconfiguration and Insecure Design	–	2020-07-16	–	90
Wordpress unzip_file path traversal#205481	Valid	Misconfiguration and Insecure Design	–	2020-01-29	–	119
RCE as Admin defeats WordPress hardening and file permissionsAnalysed#436928	Valid	File and Path Handling	–	2020-06-09	–	164

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (549 analysed so far), which can be wrong. Data as of 2026-11-14.