WordPress DB Class, bad implementation of prepare method guides to sqli and information disclosure #179920 Valid SQL Injection – 2017-11-13 – 17 Unauthenticated private CSV export of Meetup organizer PII via broken authz check in WordCamp Reports #3871816 Valid Access Control High 2026-11-05 – 16 Clickjacking In jobs.wordpress.net #223024 Valid Misconfiguration and Insecure Design – 2018-08-22 – 16 Reflected XSS at https://da.wordpress.org/themes/?s= via "s=" parameter #222040 Valid Cross-site Scripting – 2017-07-26 – 16 Reflected XSS: Taxonomy Converter via tax parameter #495515 Valid Cross-site Scripting – 2019-08-28 – 15 Stored self-XSS in mercantile.wordpress.org checkout #230232 Valid Cross-site Scripting – 2017-07-14 – 15 Authenticated Cross-site Scripting in Template Name #220903 Valid Cross-site Scripting – 2017-11-18 – 15 CSRF to add admin [wordpress] #149589 Valid Cross-Site Request Forgery – 2017-06-30 – 15 Stored XSS in Post Preview as Contributor #497724 Valid Cross-site Scripting – 2020-08-18 – 14 Open Redirect on the nl.wordpress.net #309058 Valid Open Redirect – 2018-02-22 – 14 Buddypress 2.9.1 - Exceeding the maximum upload size - XSS leading to potential RCE. #263109 Valid No weakness recorded – 2017-11-02 – 14 Clickjacking wordcamp.org #230581 Valid Misconfiguration and Insecure Design – 2017-06-24 – 14 [mercantile.wordpress.org] Reflected XSS #240256 Valid Cross-site Scripting – 2018-08-30 – 13 Missing SSL can leak job token #222036 Valid Cryptography – 2017-11-01 – 13 Improper Access Control in Buddypress core allows reply,delete any user's activity #837256 Valid Access Control – 2020-05-22 – 12 pre-auth Stored XSS in comments via javascript: url when administrator edits user supplied comment #633231 Valid Cross-site Scripting – 2020-08-18 – 12 [support.wordcamp.org] - publicly accessible .svn repository #309714 Valid Access Control – 2018-02-01 – 12 Clickjacking mercantile.wordpress.org #264125 Valid Misconfiguration and Insecure Design – 2017-09-08 – 12 Stored xss via template injection #250837 Valid Cross-site Scripting – 2017-12-11 – 12 Lack of Sanitization and Insufficient Authentication #249759 Valid Cross-site Scripting – 2017-12-26 – 11 xss - reflected #384112 Valid Cross-site Scripting – 2018-07-24 – 10 Stored XSS on Wordpress 5.3 via Title Post #754352 N/A Cross-site Scripting – 2019-12-10 – 9 Parameter tampering : Price Manipulation of Products #682344 Duplicate Input Validation and Logic – 2019-08-29 – 9 XSS on support.wordcamp.org in ajax-quote.php #355773 Valid Cross-site Scripting – 2018-07-23 – 9 MediaElements XSS #299112 Valid Cross-site Scripting – 2018-02-15 – 9 code.wordpress.net subdomain Takeover #295330 Valid No weakness recorded – 2018-03-11 – 9 [Buddypress] Arbitrary File Deletion through bp_avatar_set #183568 Valid No weakness recorded – 2017-08-22 – 9 Allow authenticated users can edit, trash,and add new in BuddyPress Emails function #833782 Valid Access Control – 2020-05-22 – 8 Account takeover vulnerability by editor role privileged users/attackers via clickjacking #388254 N/A Misconfiguration and Insecure Design – 2018-09-03 – 8 Clickjacking - https://mercantile.wordpress.org/ #258283 Valid Misconfiguration and Insecure Design – 2017-08-28 – 8 Self-XSS in WordPress Editor Link Modal #224556 Valid Cross-site Scripting – 2017-11-08 – 8 Stored but [SELF] XSS in mercantile.wordpress.org #222224 Valid Cross-site Scripting – 2017-05-26 – 8 [BuddyPress 2.9.1] Open Redirect via "wp_http_referer" parameter on "bp-profile-edit" endpoint #277502 Valid Open Redirect – 2017-11-02 – 7 Lack of Password Confirmation when Changing Password and Email #224214 Duplicate No weakness recorded – 2017-04-28 – 7 Privilege Escalation in BuddyPress core allows Moderate to Administrator #837018 Valid No weakness recorded – 2020-05-22 – 6 Unauthenticated hidden groups disclosure via Ajax groups search #282176 Valid Access Control – 2017-11-02 – 6 WordPress core - Denial of Service via Cross Site Request Forgery #153093 Valid Denial of Service – 2017-11-16 – 6 CSRF on comment post #914232 N/A Cross-Site Request Forgery – 2020-07-16 – 5 CSRF in Profile Fields allows deleting any field in BuddyPress #836187 Valid Cross-Site Request Forgery – 2020-05-22 – 5 Wordpress 4.8.1 - Rogue editor leads to RCE. And the risks of same origin frame scripting in general #263718 Informative No weakness recorded – 2017-10-04 – 4 Administrator(s) Information disclosure via JSON on wordpress.org #221734 N/A Information Disclosure – 2017-04-19 – 4 antispambot does not always escape <, >, &, " and ' #298218 Informative Cross-site Scripting – 2019-09-16 – 3 Stored XSS in WordPress #276105 Informative Cross-site Scripting – 2018-02-02 – 3 Clickjacking irclogs.wordpress.org #267075 Informative Misconfiguration and Insecure Design – 2017-10-12 – 2 WordPress Automatic Update Protocol Does Not Authenticate Updates Provided by the Server #228854 N/A Cryptography – 2019-07-22 – 2 UnResolved ChangeSet are Visible to Public That also Causes Information Disclosure #282843 Informative Information Disclosure – 2018-02-05 – 1