Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Stored XSS in wordpress.comAnalysed#733248 | Valid | Cross-site Scripting | High | 2020-02-17 | – | 356 |
| IDOR when editing users leads to Account Takeover without User Interaction at CrowdSignalAnalysed#915114 | Valid | Insecure Direct Object Reference | Critical | 2020-11-18 | – | 202 |
| IDOR leads to Edit Anyone's Blogs / WebsitesAnalysed#974222 | Valid | Insecure Direct Object Reference | High | 2020-11-18 | – | 177 |
| SQL Injection Union BasedAnalysed#1046084 | Valid | No weakness recorded | Critical | 2021-01-01 | – | 137 |
| [intensedebate.com] SQL Injection Time Based On /js/commentAction/Analysed#1044698 | Valid | SQL Injection | Critical | 2021-01-01 | – | 130 |
| Email Verification bypass on signupAnalysed#1040047 | Valid | Misconfiguration and Insecure Design | High | 2020-12-03 | – | 127 |
| Permanent DoS with one click.Analysed#975827 | Valid | Denial of Service | Medium | 2020-11-19 | – | 127 |
| Stored XSS vulnerability in comments on *.wordpress.comAnalysed#707720 | Valid | Cross-site Scripting | Medium | 2019-10-21 | – | 118 |
| XSS in Email Input [intensedebate.com]Analysed#1037714 | Valid | Cross-site Scripting | Medium | 2020-12-26 | – | 105 |
| Woocommerce SQL Injection in WC_Report_Coupon_UsageAnalysed#3198980 | Valid | SQL Injection | Medium | 2025-06-24 | – | 96 |
| Stored XSS on app.crowdsignal.com + your-subdomain.survey.fm via Embed MediaAnalysed#920005 | Valid | Cross-site Scripting | Medium | 2020-11-18 | – | 96 |
| IDOR when moving contents at CrowdSignalAnalysed#915127 | Valid | Insecure Direct Object Reference | High | 2020-11-18 | – | 94 |
| Race condition on add 1 free domainAnalysed#2616045 | Valid | Input Validation and Logic | Medium | 2025-05-09 | – | 93 |
| DOM-Based XSS in tumblr.comAnalysed#882546 | Valid | Cross-site Scripting | Medium | 2020-07-27 | – | 91 |
| Authenticated Code Execution through Phar deserialization in CSV Importer as Shop manager in WooCommerceAnalysed#403083 | Valid | Deserialization and Object Injection | High | 2019-12-19 | – | 84 |
| Stored XSS on https://app.crowdsignal.com/surveys/[Survey-Id]/question - BypassAnalysed#974271 | Valid | Cross-site Scripting | High | 2020-11-18 | – | 78 |
| Stored Self XSS on https://app.crowdsignal.com (in Photo Insert App) + Stored XSS on https://*your-subdomain*.survey.fmAnalysed#667188 | Valid | Cross-site Scripting | High | 2019-10-21 | – | 68 |
| No Email Checking at Invitation Confirmation Link leads to Account Takeover without User Interaction at CrowdSignalAnalysed#915110 | Valid | Access Control | Critical | 2020-11-18 | – | 63 |
| SSRF and local file disclosure in https://wordpress.com/media/videos/ via FFmpeg HLS processingAnalysed#237381 | Valid | Information Disclosure | – | 2017-07-29 | – | 62 |
| Stored XSS on wordpress.comAnalysed#2012636 | Valid | Cross-site Scripting | Medium | 2023-06-26 | – | 60 |
| IDOR in API applications (able to see any API token, leads to account takeover)Analysed#1695454 | Valid | Insecure Direct Object Reference | Critical | 2022-11-01 | – | 58 |
| [api.tumblr.com] Denial of Service by cookies manipulationAnalysed#1005421 | Valid | Denial of Service | Medium | 2020-11-29 | – | 55 |
| Stored XSS in Intense Debate comment systemAnalysed#1039750 | Valid | Cross-site Scripting | High | 2021-02-14 | – | 52 |
| Able to comment/view in others support ticket at https://en.instagram-brand.com/requests/dashboardAnalysed#1007988 | Valid | Information Disclosure | High | 2020-12-05 | – | 52 |
| [IDOR] Attacker user can Approve/Decline AFK on the behalf of other usersAnalysed#725569 | Valid | Insecure Direct Object Reference | – | 2019-12-01 | – | 51 |
| [intensedebate.com] No Rate Limit On The report Functionality Lead To Delete Any Comment When it is enabledAnalysed#1051734 | Valid | Input Validation and Logic | High | 2021-01-23 | – | 50 |
| IDOR when editing email leads to Account Takeover on AtavistAnalysed#950881 | Valid | Insecure Direct Object Reference | Critical | 2020-11-18 | – | 50 |
| Stored XSS in wordpress.comAnalysed#1054526 | Valid | Cross-site Scripting | High | 2021-02-17 | – | 48 |
| Sensei LMS IDOR to send messageAnalysed#1592596 | Valid | Insecure Direct Object Reference | Low | 2022-08-04 | – | 45 |
| reflected xss in https://wordpress.com/start/account/userAnalysed#2055132 | Valid | Cross-site Scripting | Medium | 2023-11-15 | – | 43 |
| Authentication bypass on JetPack SSO manager - Allows to access the administration panel of wordpress without user interactionAnalysed#2037902 | Valid | No weakness recorded | High | 2023-12-28 | – | 41 |
| Stored XSS in Jetpack's Simple Payment Module by Contributors / AuthorsAnalysed#402753 | Valid | Cross-site Scripting | Medium | 2019-12-19 | – | 41 |
| WooCommerce: Persistent XSS via customer address (state/county)Analysed#530499 | Valid | Cross-site Scripting | High | 2019-05-26 | – | 40 |
| Timeline API returns private post when target of a push notificationAnalysed#2258950 | Valid | Access Control | Low | 2024-10-17 | – | 38 |
| Stored XSS on app.crowdsignal.com your-subdomain.crowdsignal.net via Thank You HeaderAnalysed#1842822 | Valid | Cross-site Scripting | Medium | 2023-02-24 | – | 34 |
| SSRF & Blind XSS in Gravatar emailAnalysed#1100096 | Valid | Cross-site Scripting | High | 2022-01-17 | – | 34 |
| Stored XSS on wordpress.comAnalysed#1987172 | Valid | Cross-site Scripting | Medium | 2023-05-19 | – | 32 |
| [api.tumblr.com] Exploiting clickjacking vulnerability to trigger self DOM-based XSSAnalysed#953579 | Valid | Misconfiguration and Insecure Design | Low | 2020-10-09 | – | 32 |
| Site-wide CSRF at AtavistAnalysed#951292 | Valid | No weakness recorded | High | 2020-11-18 | – | 32 |
| Can buy Atavist Magazine subscription for freeAnalysed#951230 | Valid | Access Control | High | 2020-11-18 | – | 29 |
| WooCommerce Blacklist in 'map_meta_cap' leads to Privilege Escalation of ShopmanagersAnalysed#403039 | Valid | Access Control | High | 2019-12-19 | – | 28 |
| RCE via Print function [Simplenote 1.1.3 - Desktop app]Analysed#358049 | Valid | Command and Code Injection | High | 2018-07-26 | – | 28 |
| [intensedebate.com] XSS Reflected POST-Based on update/tumblr2/{$id}Analysed#1040639 | Valid | Cross-site Scripting | Medium | 2021-01-23 | – | 25 |
| [tumblr.com] 69< Firefox Only XSS ReflectedAnalysed#915756 | Valid | Cross-site Scripting | Medium | 2020-07-09 | – | 25 |
| WordPress core stored XSS via attachment file nameAnalysed#139245 | Valid | Cross-site Scripting | – | 2016-08-05 | – | 25 |
| Gaining unlimited bonus points on websites with WooCommerce Points and RewardsAnalysed#592803 | Valid | Input Validation and Logic | High | 2019-07-05 | – | 23 |
| IDOR at 'media_code' when addings media to questionsAnalysed#915133 | Valid | Insecure Direct Object Reference | Medium | 2020-11-18 | – | 22 |
| No rate limit on app.crowdsignal.com (Finish quiz)Analysed#568832 | Valid | Input Validation and Logic | Low | 2019-07-27 | – | 21 |
| Stored XSS in learnboost.com via the lesson[goals] parameter.Analysed#300270 | Valid | Cross-site Scripting | – | 2018-04-22 | – | 21 |
| xss filter bypass [polldaddy]Analysed#264832 | Valid | Cross-site Scripting | – | 2017-10-01 | – | 21 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,365 analysed so far), which can be wrong. Data as of 2026-11-15.