Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Stored XSS VulnerabilityAnalysed#643908	Valid	Cross-site Scripting	–	2019-07-18	–	403
Stored XSS in Private Message component (BuddyPress)Analysed#487081	Valid	Cross-site Scripting	–	2019-03-08	–	337
Stored XSS on byddypress Plug-in via groups nameAnalysed#592316	Valid	Cross-site Scripting	–	2019-07-27	–	132
Reflected XSS on https://make.wordpress.org via 'channel' parameter#659419	Valid	Cross-site Scripting	–	2019-08-26	–	97
CSRF to HTML Injection in Comments#428019	Valid	Cross-Site Request Forgery	–	2019-05-13	–	95
Mssing Authorization on Private Message replies (BuddyPress)#490782	Valid	Access Control	–	2019-03-08	–	66
plugins.trac.wordpress.org likely vulnerable to Cross Site Tracing (xst), TRACE HTTP method should be disabled#222692	Valid	Misconfiguration and Insecure Design	–	2019-11-03	–	58
Logic flaw in the Post creation process allows creating posts with arbitrary types without needing the corresponding nonce#404323	Valid	Input Validation and Logic	–	2019-02-14	–	38
"Bad Protocols Validation" Bypass in "wp_kses_bad_protocol_once" using HTML-encoding without trailing semicolons#339483	Valid	Cross-site Scripting	–	2019-11-16	–	34
Add users to groups who have restricted group invites#538008	Valid	Access Control	–	2019-07-27	–	32
[FG-VD-18-165] Wordpress Cross-Site Scripting Vulnerability Notification II#460911	Valid	Cross-site Scripting	–	2019-10-11	–	20
Reflected XSS: Taxonomy Converter via tax parameter#495515	Valid	Cross-site Scripting	–	2019-08-28	–	15
Stored XSS on Wordpress 5.3 via Title Post#754352	N/A	Cross-site Scripting	–	2019-12-10	–	9
Parameter tampering : Price Manipulation of Products#682344	Duplicate	Input Validation and Logic	–	2019-08-29	–	9
antispambot does not always escape <, >, &, " and '#298218	Informative	Cross-site Scripting	–	2019-09-16	–	3
WordPress Automatic Update Protocol Does Not Authenticate Updates Provided by the Server#228854	N/A	Cryptography	–	2019-07-22	–	2

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (779 analysed so far), which can be wrong. Data as of 2026-11-14.