Stored XSS Vulnerability Analysed #643908 Valid Cross-site Scripting – 2019-07-18 – 403 Stored XSS in Private Message component (BuddyPress) Analysed #487081 Valid Cross-site Scripting – 2019-03-08 – 337 RCE as Admin defeats WordPress hardening and file permissions #436928 Valid File and Path Handling – 2020-06-09 – 164 Stored XSS on byddypress Plug-in via groups name #592316 Valid Cross-site Scripting – 2019-07-27 – 132 Wordpress unzip_file path traversal #205481 Valid Misconfiguration and Insecure Design – 2020-01-29 – 119 Reflected XSS on https://make.wordpress.org via 'channel' parameter #659419 Valid Cross-site Scripting – 2019-08-26 – 97 CSRF to HTML Injection in Comments #428019 Valid Cross-Site Request Forgery – 2019-05-13 – 95 Privilege Escalation via REST API to Administrator leads to RCE #1107282 Valid Access Control – 2021-05-17 – 92 Clickjacking on donation page #921709 Valid Misconfiguration and Insecure Design – 2020-07-16 – 90 Potential unprivileged Stored XSS through wp_targeted_link_rel #509930 Valid Cross-site Scripting – 2020-01-08 – 80 Mssing Authorization on Private Message replies (BuddyPress) #490782 Valid Access Control – 2019-03-08 – 66 Pivilege escalation of any new user to Keymaster caused by CSRF #2999394 Valid Access Control Medium 2025-09-13 – 61 plugins.trac.wordpress.org likely vulnerable to Cross Site Tracing (xst), TRACE HTTP method should be disabled #222692 Valid Misconfiguration and Insecure Design – 2019-11-03 – 58 Unauthenticated disclosure of draft/private/pending post titles & IDs via Secure Custom Fields nopriv AJAX field-query handlers (post_object/relations #3893632 Valid Access Control Medium 2026-09-28 – 51 wp-embed XSS on Safari #1238528 Valid Cross-site Scripting – 2023-07-01 – 49 Author → arbitrary file deletion anywhere on disk (site takeover) via `POST /wp/v2/media/<id>/finalize` poisoning `_wp_attachment_metadata` #3931777 Valid File and Path Handling Critical 2026-08-28 – 48 Authenticated XXE #1095645 Valid Injection and Smuggling – 2021-05-18 – 41 Logic flaw in the Post creation process allows creating posts with arbitrary types without needing the corresponding nonce #404323 Valid Input Validation and Logic – 2019-02-14 – 38 WordPress 7.1 Media Processing Race Enables Persistent PHP File Write and Author-to-RCE #3923967 Valid Command and Code Injection High 2026-10-21 – 37 CampTix [camptix_private]: the view token is derived from the requester's own IP, so naming any attendee's e-mail unlocks the gated content #4043537 Valid Authentication Medium 2026-10-30 – 36 Multiple stored XSS in WordPress #221507 Valid Cross-site Scripting – 2018-11-16 – 35 "Bad Protocols Validation" Bypass in "wp_kses_bad_protocol_once" using HTML-encoding without trailing semicolons #339483 Valid Cross-site Scripting – 2019-11-16 – 34 Author → stored XSS in wp-admin: unescaped sub-size filename from attachment metadata breaks out of the `src` attribute in `get_media_item()` #3931771 Valid Cross-site Scripting Critical 2026-08-28 – 32 Add users to groups who have restricted group invites #538008 Valid Access Control – 2019-07-27 – 32 Information / sensitive data disclosure on some endpoints #273726 Valid Information Disclosure – 2018-08-22 – 32 wordpress.org/openverse/: unauthenticated open redirect — `str_replace()`'s 4th arg is a count, not a limit; bypasses WordPress.org SSO allow-list #3933198 Valid Open Redirect Medium 2026-10-30 – 31 [mercantile.wordpress.org] Reflected XSS via AngularJS Template Injection #230234 Valid Cross-site Scripting – 2017-06-14 – 29 Unauthenticated Disclosure of Private, Draft, and Password-Protected Post Content via Core Read-Permission Bypass in SCF Reference Fields #4152553 Valid Information Disclosure High 2026-11-05 – 27 Information Disclosure - Unauthen Leak Private Content #4053546 Valid Information Disclosure Medium 2026-10-10 – 27 wordpress.org Rosetta: invite stores unvalidated role — Editor can assign site Administrator despite editable_roles #3942522 Valid Access Control High 2026-11-05 – 24 Authenticated Stored Cross-site Scripting in bbPress #881918 Valid Cross-site Scripting – 2020-06-29 – 24 WordCamp Meta gpre: password-protected event RSVP list readable without password via /gpre/v1/.../rsvp-responses #4029867 Valid Access Control Medium 2026-11-05 – 23 Unauthenticated disclosure of private and hidden forum content in bbPress via the WordPress core REST single-item endpoint #3801107 Valid Access Control Critical 2026-10-12 – 23 Stored XSS on Broken Themes via filename #406289 Valid Cross-site Scripting – 2020-08-25 – 23 Wordpress 4.7.2 - Two XSS in Media Upload when file too large. #203515 Valid Cross-site Scripting – 2017-07-17 – 23 XSS via unicode characters in upload filename #179695 Valid Cross-site Scripting – 2020-08-28 – 23 Content Spoofing @ https://irclogs.wordpress.org/ #278151 Valid Access Control – 2017-12-04 – 22 Arbitrary change of blog's background image via CSRF #881855 Valid Cross-Site Request Forgery – 2020-12-14 – 21 Reflected Swf XSS In ( plugins.svn.wordpress.org ) #270060 Valid No weakness recorded – 2018-09-27 – 21 DOM Based XSS In mercantile.wordpress.org #230435 Valid Cross-site Scripting – 2017-06-14 – 21 Infrastructure - Photon - SSRF #204513 Valid Server-Side Request Forgery – 2017-07-17 – 21 Wordpress 4.7 - CSRF -> HTTP SSRF any private ip:port and basic-auth #187520 Valid Cross-Site Request Forgery – 2017-11-20 – 21 Large-site Quick Edit reparses a Contributor display name into active HTML #3878399 Valid Cross-site Scripting Medium 2026-10-21 – 20 [FG-VD-18-165] Wordpress Cross-Site Scripting Vulnerability Notification II #460911 Valid Cross-site Scripting – 2019-10-11 – 20 XSS in the search bar of mercantile.wordpress.org #221893 Valid Cross-site Scripting – 2017-05-20 – 19 Instamojo CampTix: fail-open MAC + webhook Credit without binding payment to order #3941626 Valid Access Control High 2026-11-05 – 17 PII of users can be downloaded from export pages #1172852 Valid Information Disclosure – 2023-05-12 – 17 Arbitrary file deletion in wp-core - guides towards RCE and information disclosure #291878 Valid File and Path Handling – 2018-08-29 – 17 WordPress DB Class, bad implementation of prepare method guides to sqli and information disclosure #179920 Valid SQL Injection – 2017-11-13 – 17 Unauthenticated private CSV export of Meetup organizer PII via broken authz check in WordCamp Reports #3871816 Valid Access Control High 2026-11-05 – 16