Stored XSS Vulnerability Analysed #643908 Valid Cross-site Scripting High 2019-07-18 – 403 Reflected XSS on https://make.wordpress.org via 'channel' parameter Analysed #659419 Valid Cross-site Scripting High 2019-08-26 – 97 CSRF to HTML Injection in Comments Analysed #428019 Valid Cross-Site Request Forgery High 2019-05-13 – 95 Privilege Escalation via REST API to Administrator leads to RCE Analysed #1107282 Valid Access Control High 2021-05-17 – 92 Potential unprivileged Stored XSS through wp_targeted_link_rel Analysed #509930 Valid Cross-site Scripting High 2020-01-08 – 80 Logic flaw in the Post creation process allows creating posts with arbitrary types without needing the corresponding nonce Analysed #404323 Valid Input Validation and Logic High 2019-02-14 – 38 WordPress 7.1 Media Processing Race Enables Persistent PHP File Write and Author-to-RCE Analysed #3923967 Valid Command and Code Injection High 2026-10-21 – 37 Add users to groups who have restricted group invites Analysed #538008 Valid Access Control High 2019-07-27 – 32 Unauthenticated Disclosure of Private, Draft, and Password-Protected Post Content via Core Read-Permission Bypass in SCF Reference Fields Analysed #4152553 Valid Information Disclosure High 2026-11-05 – 27 wordpress.org Rosetta: invite stores unvalidated role — Editor can assign site Administrator despite editable_roles Analysed #3942522 Valid Access Control High 2026-11-05 – 24 Wordpress 4.7.2 - Two XSS in Media Upload when file too large. Analysed #203515 Valid Cross-site Scripting High 2017-07-17 – 23 Wordpress 4.7 - CSRF -> HTTP SSRF any private ip:port and basic-auth Analysed #187520 Valid Cross-Site Request Forgery High 2017-11-20 – 21 Instamojo CampTix: fail-open MAC + webhook Credit without binding payment to order Analysed #3941626 Valid Access Control High 2026-11-05 – 17 Unauthenticated private CSV export of Meetup organizer PII via broken authz check in WordCamp Reports Analysed #3871816 Valid Access Control High 2026-11-05 – 16 pre-auth Stored XSS in comments via javascript: url when administrator edits user supplied comment #633231 Valid Cross-site Scripting High 2020-08-18 – 12 Stored xss via template injection #250837 Valid Cross-site Scripting High 2017-12-11 – 12 MediaElements XSS #299112 Valid Cross-site Scripting High 2018-02-15 – 9 [Buddypress] Arbitrary File Deletion through bp_avatar_set #183568 Valid No weakness recorded High 2017-08-22 – 9