Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Stored XSS VulnerabilityAnalysed#643908	Valid	Cross-site Scripting	High	2019-07-18	–	403
Privilege Escalation via REST API to Administrator leads to RCEAnalysed#1107282	Valid	Access Control	High	2021-05-17	–	92
Potential unprivileged Stored XSS through wp_targeted_link_relAnalysed#509930	Valid	Cross-site Scripting	High	2020-01-08	–	80
Logic flaw in the Post creation process allows creating posts with arbitrary types without needing the corresponding nonceAnalysed#404323	Valid	Input Validation and Logic	High	2019-02-14	–	38
WordPress 7.1 Media Processing Race Enables Persistent PHP File Write and Author-to-RCEAnalysed#3923967	Valid	Command and Code Injection	High	2026-10-21	–	37
Add users to groups who have restricted group invitesAnalysed#538008	Valid	Access Control	High	2019-07-27	–	32
wordpress.org Rosetta: invite stores unvalidated role — Editor can assign site Administrator despite editable_rolesAnalysed#3942522	Valid	Access Control	High	2026-11-05	–	24
Wordpress 4.7 - CSRF -> HTTP SSRF any private ip:port and basic-authAnalysed#187520	Valid	Cross-Site Request Forgery	High	2017-11-20	–	21

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.