Denial of service to WP-JSON API by cache poisoning the CORS allow origin header Analysed #591302 Valid Denial of Service Medium 2020-04-16 – 405 Stored XSS in wordpress.com Analysed #733248 Valid Cross-site Scripting High 2020-02-17 – 356 IDOR when editing users leads to Account Takeover without User Interaction at CrowdSignal Analysed #915114 Valid Insecure Direct Object Reference Critical 2020-11-18 – 202 IDOR leads to Edit Anyone's Blogs / Websites Analysed #974222 Valid Insecure Direct Object Reference High 2020-11-18 – 177 Sql injection on docs.atavist.com Analysed #1039315 Valid SQL Injection High 2020-12-08 – 170 SQL Injection Union Based Analysed #1046084 Valid No weakness recorded Critical 2021-01-01 – 137 [intensedebate.com] SQL Injection Time Based On /js/commentAction/ Analysed #1044698 Valid SQL Injection Critical 2021-01-01 – 130 Email Verification bypass on signup Analysed #1040047 Valid Misconfiguration and Insecure Design High 2020-12-03 – 127 Permanent DoS with one click. Analysed #975827 Valid Denial of Service Medium 2020-11-19 – 127 Stored XSS vulnerability in comments on *.wordpress.com Analysed #707720 Valid Cross-site Scripting Medium 2019-10-21 – 118 XSS in Email Input [intensedebate.com] Analysed #1037714 Valid Cross-site Scripting Medium 2020-12-26 – 105 SQL Injection intensedebate.com Analysed #1069561 Valid SQL Injection Medium 2021-01-11 – 102 Woocommerce SQL Injection in WC_Report_Coupon_Usage Analysed #3198980 Valid SQL Injection Medium 2025-06-24 – 96 Stored XSS on app.crowdsignal.com + your-subdomain.survey.fm via Embed Media Analysed #920005 Valid Cross-site Scripting Medium 2020-11-18 – 96 IDOR when moving contents at CrowdSignal Analysed #915127 Valid Insecure Direct Object Reference High 2020-11-18 – 94 Race condition on add 1 free domain Analysed #2616045 Valid Input Validation and Logic Medium 2025-05-09 – 93 DOM XSS on multiple Automattic domains through postMessages Analysed #2371019 Valid Cross-site Scripting High 2024-02-26 – 92 DOM-Based XSS in tumblr.com Analysed #882546 Valid Cross-site Scripting Medium 2020-07-27 – 91 Authenticated Code Execution through Phar deserialization in CSV Importer as Shop manager in WooCommerce Analysed #403083 Valid Deserialization and Object Injection High 2019-12-19 – 84 [intensedebate.com] SQL Injection Time Based on /changeReplaceOpt.php Analysed #1042746 Valid SQL Injection Critical 2021-01-01 – 80 Stored XSS on https://app.crowdsignal.com/surveys/[Survey-Id]/question - Bypass Analysed #974271 Valid Cross-site Scripting High 2020-11-18 – 78 XSS Vulnerability on Pressable/Atomic Hosting Platform via unescaped admin notices leads to code execution Analysed #3447021 Valid No weakness recorded – 2026-02-18 – 76 Reflected XSS in https://www.intensedebate.com/js/getCommentLink.php Analysed #1043804 Valid Cross-site Scripting Medium 2021-01-30 – 75 Unauthenticated access to webmail at maildev.happytools.dev leading to compromised wordpress site api.happytools.dev [RCE] Analysed #1067547 Valid Information Disclosure High 2021-02-01 – 71 WordPress Flash XSS in *flashmediaelement.swf* Analysed #134546 Valid Cross-site Scripting – 2016-07-10 – 70 Stored Self XSS on https://app.crowdsignal.com (in Photo Insert App) + Stored XSS on https://*your-subdomain*.survey.fm Analysed #667188 Valid Cross-site Scripting High 2019-10-21 – 68 Broken Authentication - Security token gets captured via man in the middle attack Analysed #206650 Valid Authentication High 2019-06-22 – 67 Disclosure of 152 cookie names via crafted input Analysed #310105 Valid Information Disclosure Low 2019-08-04 – 65 Captcha bypass for the most important function - At en.instagram-brand.com Analysed #206653 Valid No weakness recorded Medium 2019-06-22 – 65 No Email Checking at Invitation Confirmation Link leads to Account Takeover without User Interaction at CrowdSignal Analysed #915110 Valid Access Control Critical 2020-11-18 – 63 SSRF and local file disclosure in https://wordpress.com/media/videos/ via FFmpeg HLS processing Analysed #237381 Valid Information Disclosure – 2017-07-29 – 62 Stored XSS on wordpress.com Analysed #2012636 Valid Cross-site Scripting Medium 2023-06-26 – 60 Authentication & Registration Bypass in Newspack Extended Access Analysed #2536758 Valid Authentication Medium 2024-07-05 – 58 IDOR in API applications (able to see any API token, leads to account takeover) Analysed #1695454 Valid Insecure Direct Object Reference Critical 2022-11-01 – 58 XSS and HTML Injection on the pressable.com search box Analysed #1537149 Valid Cross-site Scripting Medium 2022-08-23 – 57 DOM-Based XSS in tumblr.com Analysed #949382 Valid Cross-site Scripting Medium 2021-02-02 – 56 [api.tumblr.com] Denial of Service by cookies manipulation Analysed #1005421 Valid Denial of Service Medium 2020-11-29 – 55 Stored XSS in Intense Debate comment system Analysed #1039750 Valid Cross-site Scripting High 2021-02-14 – 52 Able to comment/view in others support ticket at https://en.instagram-brand.com/requests/dashboard Analysed #1007988 Valid Information Disclosure High 2020-12-05 – 52 Wordpress VIP leaks email of the test a/c Analysed #540301 Valid Information Disclosure Medium 2019-05-28 – 52 Open redirect via redirect_to parameter in tumblr.com Analysed #2812583 Valid Open Redirect Low 2024-11-05 – 51 Authentication & Registration Bypass in Newspack Extended Access Analysed #2472798 Valid Authentication Medium 2024-05-20 – 51 [IDOR] Attacker user can Approve/Decline AFK on the behalf of other users Analysed #725569 Valid Insecure Direct Object Reference – 2019-12-01 – 51 [intensedebate.com] No Rate Limit On The report Functionality Lead To Delete Any Comment When it is enabled Analysed #1051734 Valid Input Validation and Logic High 2021-01-23 – 50 IDOR when editing email leads to Account Takeover on Atavist Analysed #950881 Valid Insecure Direct Object Reference Critical 2020-11-18 – 50 WordPress SOME bug in plupload.flash.swf leading to RCE Analysed #134738 Valid Command and Code Injection – 2016-07-10 – 50 Stored XSS in wordpress.com Analysed #1054526 Valid Cross-site Scripting High 2021-02-17 – 48 Sensei LMS IDOR to send message Analysed #1592596 Valid Insecure Direct Object Reference Low 2022-08-04 – 45 Unauthenticated Private Messages DIsclosure via wordpress Rest API Analysed #1590237 Valid Information Disclosure Medium 2022-08-04 – 45 reflected xss in https://wordpress.com/start/account/user Analysed #2055132 Valid Cross-site Scripting Medium 2023-11-15 – 43