Clickjacking In jobs.wordpress.net #223024 Valid Misconfiguration and Insecure Design Low 2018-08-22 – 16 Reflected XSS at https://da.wordpress.org/themes/?s= via "s=" parameter #222040 Valid Cross-site Scripting Medium 2017-07-26 – 16 Reflected XSS: Taxonomy Converter via tax parameter #495515 Valid Cross-site Scripting Medium 2019-08-28 – 15 Stored self-XSS in mercantile.wordpress.org checkout #230232 Valid Cross-site Scripting Low 2017-07-14 – 15 Authenticated Cross-site Scripting in Template Name #220903 Valid Cross-site Scripting Medium 2017-11-18 – 15 CSRF to add admin [wordpress] #149589 Valid Cross-Site Request Forgery – 2017-06-30 – 15 Stored XSS in Post Preview as Contributor #497724 Valid Cross-site Scripting Medium 2020-08-18 – 14 Open Redirect on the nl.wordpress.net #309058 Valid Open Redirect Low 2018-02-22 – 14 Buddypress 2.9.1 - Exceeding the maximum upload size - XSS leading to potential RCE. #263109 Valid No weakness recorded Medium 2017-11-02 – 14 Clickjacking wordcamp.org #230581 Valid Misconfiguration and Insecure Design Low 2017-06-24 – 14 [mercantile.wordpress.org] Reflected XSS #240256 Valid Cross-site Scripting Medium 2018-08-30 – 13 Missing SSL can leak job token #222036 Valid Cryptography Low 2017-11-01 – 13 Improper Access Control in Buddypress core allows reply,delete any user's activity #837256 Valid Access Control Medium 2020-05-22 – 12 pre-auth Stored XSS in comments via javascript: url when administrator edits user supplied comment #633231 Valid Cross-site Scripting High 2020-08-18 – 12 [support.wordcamp.org] - publicly accessible .svn repository #309714 Valid Access Control None 2018-02-01 – 12 Clickjacking mercantile.wordpress.org #264125 Valid Misconfiguration and Insecure Design Low 2017-09-08 – 12 Stored xss via template injection #250837 Valid Cross-site Scripting High 2017-12-11 – 12 Lack of Sanitization and Insufficient Authentication #249759 Valid Cross-site Scripting Medium 2017-12-26 – 11 xss - reflected #384112 Valid Cross-site Scripting Low 2018-07-24 – 10 XSS on support.wordcamp.org in ajax-quote.php #355773 Valid Cross-site Scripting – 2018-07-23 – 9 MediaElements XSS #299112 Valid Cross-site Scripting High 2018-02-15 – 9 code.wordpress.net subdomain Takeover #295330 Valid No weakness recorded Medium 2018-03-11 – 9 [Buddypress] Arbitrary File Deletion through bp_avatar_set #183568 Valid No weakness recorded High 2017-08-22 – 9 Allow authenticated users can edit, trash,and add new in BuddyPress Emails function #833782 Valid Access Control Medium 2020-05-22 – 8 Clickjacking - https://mercantile.wordpress.org/ #258283 Valid Misconfiguration and Insecure Design Low 2017-08-28 – 8 Self-XSS in WordPress Editor Link Modal #224556 Valid Cross-site Scripting Low 2017-11-08 – 8 Stored but [SELF] XSS in mercantile.wordpress.org #222224 Valid Cross-site Scripting Low 2017-05-26 – 8 [BuddyPress 2.9.1] Open Redirect via "wp_http_referer" parameter on "bp-profile-edit" endpoint #277502 Valid Open Redirect Low 2017-11-02 – 7 Privilege Escalation in BuddyPress core allows Moderate to Administrator #837018 Valid No weakness recorded Medium 2020-05-22 – 6 Unauthenticated hidden groups disclosure via Ajax groups search #282176 Valid Access Control Medium 2017-11-02 – 6 WordPress core - Denial of Service via Cross Site Request Forgery #153093 Valid Denial of Service – 2017-11-16 – 6 CSRF in Profile Fields allows deleting any field in BuddyPress #836187 Valid Cross-Site Request Forgery Medium 2020-05-22 – 5