Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
StatusAny
WeaknessAny class
- Any class
- Cross-site Scripting35
- Cross-Site Request Forgery6
- Open Redirect3
- Server-Side Request Forgery1
- SQL Injection1
- Command and Code Injection1
- Injection and Smuggling1
- File and Path Handling3
- Denial of Service2
- Input Validation and Logic2
- Misconfiguration and Insecure Design9
- Cryptography2
- Information Disclosure6
- Authentication1
- Access Control15
- No weakness recorded8
Access (title)Any
Access (analysis)Any
TechniqueAny
96 of 15,219 reports · 161 analysed so far
- #643908ValidAnalysedStored XSS VulnerabilityWordPress · Cross-site Scripting · 2019 · needs: a user account · Stored XSS–403votes
- #487081ValidAnalysedStored XSS in Private Message component (BuddyPress)WordPress · Cross-site Scripting · 2019 · needs: a user account · Stored XSS–337votes
- #436928ValidRCE as Admin defeats WordPress hardening and file permissionsWordPress · File and Path Handling · 2020–164votes
- #592316ValidStored XSS on byddypress Plug-in via groups nameWordPress · Cross-site Scripting · 2019–132votes
- #205481ValidWordpress unzip_file path traversalWordPress · Misconfiguration and Insecure Design · 2020–119votes
- #659419ValidReflected XSS on https://make.wordpress.org via 'channel' parameterWordPress · Cross-site Scripting · 2019–97votes
- #428019ValidCSRF to HTML Injection in CommentsWordPress · Cross-Site Request Forgery · 2019–95votes
- #1107282ValidPrivilege Escalation via REST API to Administrator leads to RCEWordPress · Access Control · 2021–92votes
- #921709ValidClickjacking on donation pageWordPress · Misconfiguration and Insecure Design · 2020–90votes
- #509930ValidPotential unprivileged Stored XSS through wp_targeted_link_relWordPress · Cross-site Scripting · 2020–80votes
- #2786591N/AUnauthenticated WordPress Database Repair DoSWordPress · Denial of Service · 2024 · High · no account (title)–70votes
- #490782ValidMssing Authorization on Private Message replies (BuddyPress)WordPress · Access Control · 2019–66votes
- #2999394ValidPivilege escalation of any new user to Keymaster caused by CSRFWordPress · Access Control · 2025 · Medium–61votes
- #222692Validplugins.trac.wordpress.org likely vulnerable to Cross Site Tracing (xst), TRACE HTTP method should be disabledWordPress · Misconfiguration and Insecure Design · 2019–58votes
- #3893632ValidUnauthenticated disclosure of draft/private/pending post titles & IDs via Secure Custom Fields nopriv AJAX field-query handlers (post_object/relationsWordPress · Access Control · 2026 · Medium · no account (title)–51votes
- #1238528Validwp-embed XSS on SafariWordPress · Cross-site Scripting · 2023–49votes
- #3931777ValidAuthor → arbitrary file deletion anywhere on disk (site takeover) via `POST /wp/v2/media/<id>/finalize` poisoning `_wp_attachment_metadata`WordPress · File and Path Handling · 2026 · Critical–48votes
- #1095645ValidAuthenticated XXEWordPress · Injection and Smuggling · 2021–41votes
- #404323ValidLogic flaw in the Post creation process allows creating posts with arbitrary types without needing the corresponding nonceWordPress · Input Validation and Logic · 2019–38votes
- #3923967ValidWordPress 7.1 Media Processing Race Enables Persistent PHP File Write and Author-to-RCEWordPress · Command and Code Injection · 2026 · High–37votes
- #4043537ValidCampTix [camptix_private]: the view token is derived from the requester's own IP, so naming any attendee's e-mail unlocks the gated contentWordPress · Authentication · 2026 · Medium–36votes
- #221507ValidMultiple stored XSS in WordPressWordPress · Cross-site Scripting · 2018–35votes
- #339483Valid"Bad Protocols Validation" Bypass in "wp_kses_bad_protocol_once" using HTML-encoding without trailing semicolonsWordPress · Cross-site Scripting · 2019–34votes
- #3931771ValidAuthor → stored XSS in wp-admin: unescaped sub-size filename from attachment metadata breaks out of the `src` attribute in `get_media_item()`WordPress · Cross-site Scripting · 2026 · Critical–32votes
- #538008ValidAdd users to groups who have restricted group invitesWordPress · Access Control · 2019–32votes
- #273726ValidInformation / sensitive data disclosure on some endpointsWordPress · Information Disclosure · 2018–32votes
- #3933198Validwordpress.org/openverse/: unauthenticated open redirect — `str_replace()`'s 4th arg is a count, not a limit; bypasses WordPress.org SSO allow-listWordPress · Open Redirect · 2026 · Medium · no account (title)–31votes
- #230234Valid[mercantile.wordpress.org] Reflected XSS via AngularJS Template InjectionWordPress · Cross-site Scripting · 2017–29votes
- #4152553ValidUnauthenticated Disclosure of Private, Draft, and Password-Protected Post Content via Core Read-Permission Bypass in SCF Reference FieldsWordPress · Information Disclosure · 2026 · High · no account (title)–27votes
- #4053546ValidInformation Disclosure - Unauthen Leak Private ContentWordPress · Information Disclosure · 2026 · Medium–27votes
- #385322N/AOpen API For Username enumerationWordPress · No weakness recorded · 2018–25votes
- #3942522Validwordpress.org Rosetta: invite stores unvalidated role — Editor can assign site Administrator despite editable_rolesWordPress · Access Control · 2026 · High–24votes
- #881918ValidAuthenticated Stored Cross-site Scripting in bbPressWordPress · Cross-site Scripting · 2020–24votes
- #4029867ValidWordCamp Meta gpre: password-protected event RSVP list readable without password via /gpre/v1/.../rsvp-responsesWordPress · Access Control · 2026 · Medium–23votes
- #3801107ValidUnauthenticated disclosure of private and hidden forum content in bbPress via the WordPress core REST single-item endpointWordPress · Access Control · 2026 · Critical · no account (title)–23votes
- #406289ValidStored XSS on Broken Themes via filenameWordPress · Cross-site Scripting · 2020–23votes
- #203515ValidWordpress 4.7.2 - Two XSS in Media Upload when file too large.WordPress · Cross-site Scripting · 2017–23votes
- #179695ValidXSS via unicode characters in upload filenameWordPress · Cross-site Scripting · 2020–23votes
- #278151ValidContent Spoofing @ https://irclogs.wordpress.org/WordPress · Access Control · 2017–22votes
- #881855ValidArbitrary change of blog's background image via CSRFWordPress · Cross-Site Request Forgery · 2020–21votes
- #270060ValidReflected Swf XSS In ( plugins.svn.wordpress.org )WordPress · No weakness recorded · 2018–21votes
- #230435ValidDOM Based XSS In mercantile.wordpress.orgWordPress · Cross-site Scripting · 2017–21votes
- #204513ValidInfrastructure - Photon - SSRFWordPress · Server-Side Request Forgery · 2017–21votes
- #187520ValidWordpress 4.7 - CSRF -> HTTP SSRF any private ip:port and basic-authWordPress · Cross-Site Request Forgery · 2017–21votes
- #3878399ValidLarge-site Quick Edit reparses a Contributor display name into active HTMLWordPress · Cross-site Scripting · 2026 · Medium–20votes
- #460911Valid[FG-VD-18-165] Wordpress Cross-Site Scripting Vulnerability Notification IIWordPress · Cross-site Scripting · 2019–20votes
- #221893ValidXSS in the search bar of mercantile.wordpress.orgWordPress · Cross-site Scripting · 2017–19votes
- #3941626ValidInstamojo CampTix: fail-open MAC + webhook Credit without binding payment to orderWordPress · Access Control · 2026 · High–17votes
- #1172852ValidPII of users can be downloaded from export pagesWordPress · Information Disclosure · 2023–17votes
- #291878ValidArbitrary file deletion in wp-core - guides towards RCE and information disclosureWordPress · File and Path Handling · 2018–17votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.