Denial of service to WP-JSON API by cache poisoning the CORS allow origin header Analysed #591302 Valid Denial of Service – 2020-04-16 – 405 Stored XSS in wordpress.com Analysed #733248 Valid Cross-site Scripting – 2020-02-17 – 356 IDOR when editing users leads to Account Takeover without User Interaction at CrowdSignal Analysed #915114 Valid Insecure Direct Object Reference – 2020-11-18 – 202 IDOR leads to Edit Anyone's Blogs / Websites Analysed #974222 Valid Insecure Direct Object Reference – 2020-11-18 – 177 Sql injection on docs.atavist.com Analysed #1039315 Valid SQL Injection – 2020-12-08 – 170 SQL Injection Union Based Analysed #1046084 Valid No weakness recorded – 2021-01-01 – 137 [intensedebate.com] SQL Injection Time Based On /js/commentAction/ Analysed #1044698 Valid SQL Injection – 2021-01-01 – 130 Email Verification bypass on signup Analysed #1040047 Valid Misconfiguration and Insecure Design – 2020-12-03 – 127 Permanent DoS with one click. Analysed #975827 Valid Denial of Service – 2020-11-19 – 127 Stored XSS vulnerability in comments on *.wordpress.com #707720 Valid Cross-site Scripting – 2019-10-21 – 118 XSS in Email Input [intensedebate.com] #1037714 Valid Cross-site Scripting – 2020-12-26 – 105 SQL Injection intensedebate.com #1069561 Valid SQL Injection – 2021-01-11 – 102 Woocommerce SQL Injection in WC_Report_Coupon_Usage #3198980 Valid SQL Injection Medium 2025-06-24 – 96 Stored XSS on app.crowdsignal.com + your-subdomain.survey.fm via Embed Media #920005 Valid Cross-site Scripting – 2020-11-18 – 96 IDOR when moving contents at CrowdSignal #915127 Valid Insecure Direct Object Reference – 2020-11-18 – 94 Race condition on add 1 free domain #2616045 Valid Input Validation and Logic Medium 2025-05-09 – 93 DOM XSS on multiple Automattic domains through postMessages #2371019 Valid Cross-site Scripting High 2024-02-26 – 92 DOM-Based XSS in tumblr.com #882546 Valid Cross-site Scripting – 2020-07-27 – 91 Authenticated Code Execution through Phar deserialization in CSV Importer as Shop manager in WooCommerce #403083 Valid Deserialization and Object Injection – 2019-12-19 – 84 [intensedebate.com] SQL Injection Time Based on /changeReplaceOpt.php #1042746 Valid SQL Injection – 2021-01-01 – 80 Stored XSS on https://app.crowdsignal.com/surveys/[Survey-Id]/question - Bypass #974271 Valid Cross-site Scripting – 2020-11-18 – 78 XSS Vulnerability on Pressable/Atomic Hosting Platform via unescaped admin notices leads to code execution #3447021 Valid No weakness recorded – 2026-02-18 – 76 Reflected XSS in https://www.intensedebate.com/js/getCommentLink.php #1043804 Valid Cross-site Scripting – 2021-01-30 – 75 Unauthenticated access to webmail at maildev.happytools.dev leading to compromised wordpress site api.happytools.dev [RCE] #1067547 Valid Information Disclosure – 2021-02-01 – 71 WordPress Flash XSS in *flashmediaelement.swf* #134546 Valid Cross-site Scripting – 2016-07-10 – 70 Stored Self XSS on https://app.crowdsignal.com (in Photo Insert App) + Stored XSS on https://*your-subdomain*.survey.fm #667188 Valid Cross-site Scripting – 2019-10-21 – 68 Broken Authentication - Security token gets captured via man in the middle attack #206650 Valid Authentication – 2019-06-22 – 67 Disclosure of 152 cookie names via crafted input #310105 Valid Information Disclosure – 2019-08-04 – 65 Captcha bypass for the most important function - At en.instagram-brand.com #206653 Valid No weakness recorded – 2019-06-22 – 65 No Email Checking at Invitation Confirmation Link leads to Account Takeover without User Interaction at CrowdSignal #915110 Valid Access Control – 2020-11-18 – 63 SSRF and local file disclosure in https://wordpress.com/media/videos/ via FFmpeg HLS processing #237381 Valid Information Disclosure – 2017-07-29 – 62 Stored XSS on wordpress.com #2012636 Valid Cross-site Scripting Medium 2023-06-26 – 60 Authentication & Registration Bypass in Newspack Extended Access #2536758 Valid Authentication Medium 2024-07-05 – 58 IDOR in API applications (able to see any API token, leads to account takeover) #1695454 Valid Insecure Direct Object Reference – 2022-11-01 – 58 XSS and HTML Injection on the pressable.com search box #1537149 Valid Cross-site Scripting – 2022-08-23 – 57 DOM-Based XSS in tumblr.com #949382 Valid Cross-site Scripting – 2021-02-02 – 56 [api.tumblr.com] Denial of Service by cookies manipulation #1005421 Valid Denial of Service – 2020-11-29 – 55 Stored XSS in Intense Debate comment system #1039750 Valid Cross-site Scripting – 2021-02-14 – 52 Able to comment/view in others support ticket at https://en.instagram-brand.com/requests/dashboard #1007988 Valid Information Disclosure – 2020-12-05 – 52 Wordpress VIP leaks email of the test a/c #540301 Valid Information Disclosure – 2019-05-28 – 52 Open redirect via redirect_to parameter in tumblr.com #2812583 Valid Open Redirect Low 2024-11-05 – 51 Authentication & Registration Bypass in Newspack Extended Access #2472798 Valid Authentication Medium 2024-05-20 – 51 [IDOR] Attacker user can Approve/Decline AFK on the behalf of other users #725569 Valid Insecure Direct Object Reference – 2019-12-01 – 51 [intensedebate.com] No Rate Limit On The report Functionality Lead To Delete Any Comment When it is enabled #1051734 Valid Input Validation and Logic – 2021-01-23 – 50 IDOR when editing email leads to Account Takeover on Atavist #950881 Valid Insecure Direct Object Reference – 2020-11-18 – 50 WordPress SOME bug in plupload.flash.swf leading to RCE #134738 Valid Command and Code Injection – 2016-07-10 – 50 Stored XSS in wordpress.com #1054526 Valid Cross-site Scripting – 2021-02-17 – 48 Sensei LMS IDOR to send message #1592596 Valid Insecure Direct Object Reference – 2022-08-04 – 45 Unauthenticated Private Messages DIsclosure via wordpress Rest API #1590237 Valid Information Disclosure – 2022-08-04 – 45 reflected xss in https://wordpress.com/start/account/user #2055132 Valid Cross-site Scripting Medium 2023-11-15 – 43