Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Stored XSS VulnerabilityAnalysed#643908	Valid	Cross-site Scripting	High	2019-07-18	–	403
Stored XSS in Private Message component (BuddyPress)Analysed#487081	Valid	Cross-site Scripting	Critical	2019-03-08	–	337
Stored XSS on byddypress Plug-in via groups nameAnalysed#592316	Valid	Cross-site Scripting	Low	2019-07-27	–	132
Reflected XSS on https://make.wordpress.org via 'channel' parameterAnalysed#659419	Valid	Cross-site Scripting	High	2019-08-26	–	97
CSRF to HTML Injection in CommentsAnalysed#428019	Valid	Cross-Site Request Forgery	High	2019-05-13	–	95
Mssing Authorization on Private Message replies (BuddyPress)Analysed#490782	Valid	Access Control	Low	2019-03-08	–	66
plugins.trac.wordpress.org likely vulnerable to Cross Site Tracing (xst), TRACE HTTP method should be disabledAnalysed#222692	Valid	Misconfiguration and Insecure Design	–	2019-11-03	–	58
Logic flaw in the Post creation process allows creating posts with arbitrary types without needing the corresponding nonceAnalysed#404323	Valid	Input Validation and Logic	High	2019-02-14	–	38
"Bad Protocols Validation" Bypass in "wp_kses_bad_protocol_once" using HTML-encoding without trailing semicolonsAnalysed#339483	Valid	Cross-site Scripting	Medium	2019-11-16	–	34
Add users to groups who have restricted group invitesAnalysed#538008	Valid	Access Control	High	2019-07-27	–	32
[FG-VD-18-165] Wordpress Cross-Site Scripting Vulnerability Notification IIAnalysed#460911	Valid	Cross-site Scripting	Medium	2019-10-11	–	20
Reflected XSS: Taxonomy Converter via tax parameterAnalysed#495515	Valid	Cross-site Scripting	Medium	2019-08-28	–	15

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.