Browse / Automattic

Automattic

See its reports on the map

Attack surface: 277 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to Automattic

• Cross-site Scripting59
• Authentication18
• Information Disclosure12
• Cross-Site Request Forgery10
• Insecure Direct Object Reference9
• Code Execution9

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Denial of service to WP-JSON API by cache poisoning the CORS allow origin headerUncontrolled Resource Consumption · medium
   405 votes
2. Stored XSS in wordpress.comCross-site Scripting (XSS) - Stored · high
   356 votes
3. IDOR when editing users leads to Account Takeover without User Interaction at CrowdSignalInsecure Direct Object Reference (IDOR) · critical
   202 votes
4. IDOR leads to Edit Anyone's Blogs / WebsitesInsecure Direct Object Reference (IDOR) · high
   177 votes
5. Sql injection on docs.atavist.comSQL Injection · high
   170 votes
6. SQL Injection Union BasedSQL Injection · critical
   137 votes
7. [intensedebate.com] SQL Injection Time Based On /js/commentAction/SQL Injection · critical
   130 votes
8. Email Verification bypass on signupViolation of Secure Design Principles · high
   127 votes
9. Permanent DoS with one click.Uncontrolled Resource Consumption · medium
   127 votes
10. Stored XSS vulnerability in comments on *.wordpress.comCross-site Scripting (XSS) - Stored · medium
    118 votes
11. XSS in Email Input [intensedebate.com]Cross-site Scripting (XSS) - Generic · medium
    105 votes
12. SQL Injection intensedebate.comSQL Injection · medium
    102 votes
13. Woocommerce SQL Injection in WC_Report_Coupon_UsageSQL Injection · medium
    96 votes
14. Stored XSS on app.crowdsignal.com + your-subdomain.survey.fm via Embed MediaCross-site Scripting (XSS) - Stored · medium
    96 votes
15. IDOR when moving contents at CrowdSignalInsecure Direct Object Reference (IDOR) · high
    94 votes
16. Race condition on add 1 free domainBusiness Logic Errors · medium
    93 votes
17. DOM XSS on multiple Automattic domains through postMessagesCross-site Scripting (XSS) - DOM · high
    92 votes
18. DOM-Based XSS in tumblr.comCross-site Scripting (XSS) - DOM · medium
    91 votes
19. Authenticated Code Execution through Phar deserialization in CSV Importer as Shop manager in WooCommerceDeserialization of Untrusted Data · high
    84 votes
20. [intensedebate.com] SQL Injection Time Based on /changeReplaceOpt.phpSQL Injection · critical
    80 votes
21. Stored XSS on https://app.crowdsignal.com/surveys/[Survey-Id]/question - BypassCross-site Scripting (XSS) - Stored · high
    78 votes
22. XSS Vulnerability on Pressable/Atomic Hosting Platform via unescaped admin notices leads to code executionCross-site Scripting (XSS) - Generic
    76 votes
23. Reflected XSS in https://www.intensedebate.com/js/getCommentLink.phpCross-site Scripting (XSS) - Reflected · medium
    75 votes
24. Unauthenticated access to webmail at maildev.happytools.dev leading to compromised wordpress site api.happytools.dev [RCE]Information Disclosure · high
    71 votes
25. WordPress Flash XSS in *flashmediaelement.swf*Cross-site Scripting (XSS) - Generic
    70 votes
26. Stored Self XSS on https://app.crowdsignal.com (in Photo Insert App) + Stored XSS on https://*your-subdomain*.survey.fmCross-site Scripting (XSS) - Stored · high
    68 votes
27. Broken Authentication - Security token gets captured via man in the middle attackImproper Authentication - Generic · high
    67 votes
28. Disclosure of 152 cookie names via crafted inputInformation Disclosure · low
    65 votes
29. Captcha bypass for the most important function - At en.instagram-brand.comImproper Restriction of Authentication Attempts · medium
    65 votes
30. No Email Checking at Invitation Confirmation Link leads to Account Takeover without User Interaction at CrowdSignalImproper Access Control - Generic · critical
    63 votes
31. SSRF and local file disclosure in https://wordpress.com/media/videos/ via FFmpeg HLS processingInformation Disclosure
    62 votes
32. Stored XSS on wordpress.comCross-site Scripting (XSS) - Stored · medium
    60 votes
33. Authentication & Registration Bypass in Newspack Extended AccessImproper Authentication - Generic · medium
    58 votes
34. IDOR in API applications (able to see any API token, leads to account takeover)Insecure Direct Object Reference (IDOR) · critical
    58 votes
35. XSS and HTML Injection on the pressable.com search boxCross-site Scripting (XSS) - Stored · medium
    57 votes
36. DOM-Based XSS in tumblr.comCross-site Scripting (XSS) - DOM · medium
    56 votes
37. [api.tumblr.com] Denial of Service by cookies manipulationUncontrolled Resource Consumption · medium
    55 votes
38. Stored XSS in Intense Debate comment systemCross-site Scripting (XSS) - Stored · high
    52 votes
39. Able to comment/view in others support ticket at https://en.instagram-brand.com/requests/dashboardInformation Disclosure · high
    52 votes
40. Wordpress VIP leaks email of the test a/cInformation Disclosure · medium
    52 votes
41. Open redirect via redirect_to parameter in tumblr.comOpen Redirect · low
    51 votes
42. Authentication & Registration Bypass in Newspack Extended AccessImproper Authentication - Generic · medium
    51 votes
43. [IDOR] Attacker user can Approve/Decline AFK on the behalf of other usersInsecure Direct Object Reference (IDOR)
    51 votes
44. [intensedebate.com] No Rate Limit On The report Functionality Lead To Delete Any Comment When it is enabledBusiness Logic Errors · high
    50 votes
45. IDOR when editing email leads to Account Takeover on AtavistInsecure Direct Object Reference (IDOR) · critical
    50 votes
46. WordPress SOME bug in plupload.flash.swf leading to RCECode Injection
    50 votes
47. Stored XSS in wordpress.comCross-site Scripting (XSS) - Stored · high
    48 votes
48. Sensei LMS IDOR to send messageInsecure Direct Object Reference (IDOR) · low
    45 votes
49. Unauthenticated Private Messages DIsclosure via wordpress Rest APIInformation Disclosure · medium
    45 votes
50. reflected xss in https://wordpress.com/start/account/userCross-site Scripting (XSS) - Reflected · medium
    43 votes
51. [intensedebate.com] XSS Reflected POST-Based Cross-site Scripting (XSS) - Reflected · low
    42 votes
52. Authentication bypass on JetPack SSO manager - Allows to access the administration panel of wordpress without user interactionImproper Authentication - Generic · high
    41 votes
53. Stored XSS in Jetpack's Simple Payment Module by Contributors / AuthorsCross-site Scripting (XSS) - Stored · medium
    41 votes
54. Authentication Bypass - Chaining two vulnerabilities leads to account takeover at en.instagram-brand.comImproper Authentication - Generic · high
    41 votes
55. WooCommerce: Persistent XSS via customer address (state/county)Cross-site Scripting (XSS) - Stored · high
    40 votes
56. cloudup Subdomain Takeover That resolves to Desk.com ( CNAME cloudup.desk.com ) Violation of Secure Design Principles · medium
    39 votes
57. Timeline API returns private post when target of a push notificationImproper Access Control - Generic · low
    38 votes
58. DOM based XSS in the WooCommerce pluginCross-site Scripting (XSS) - DOM · medium
    37 votes
59. Stored XSS on app.crowdsignal.com your-subdomain.crowdsignal.net via Thank You HeaderCross-site Scripting (XSS) - Stored · medium
    34 votes
60. SSRF & Blind XSS in Gravatar email Cross-site Scripting (XSS) - Stored · high
    34 votes
61. No Rate Limit when accessing "Password protection" enabled surveys leads to bypassing passwords via "pd-pass_surveyid" cookieBusiness Logic Errors · low
    33 votes
62. Stored XSS on wordpress.comCross-site Scripting (XSS) - Stored · medium
    32 votes
63. [api.tumblr.com] Exploiting clickjacking vulnerability to trigger self DOM-based XSSUI Redressing (Clickjacking) · low
    32 votes
64. Site-wide CSRF at Atavist Cross-Site Request Forgery (CSRF) · high
    32 votes
65. Unauthenticated RCE in VaultpressCode Injection · critical
    31 votes
66. [FG-VD-19-022] Wordpress WooCommerce Cross-Site Scripting Vulnerability NotificationCross-site Scripting (XSS) - Stored · medium
    30 votes
67. information disclosure lead to disclose users private notesInformation Disclosure · low
    29 votes
68. Can buy Atavist Magazine subscription for freeImproper Access Control - Generic · high
    29 votes
69. WooCommerce Blacklist in 'map_meta_cap' leads to Privilege Escalation of ShopmanagersPrivilege Escalation · high
    28 votes
70. RCE via Print function [Simplenote 1.1.3 - Desktop app] Code Injection · high
    28 votes
71. Insufficient DKIM record with RSA 512-bit key used on WordPress.comInadequate Encryption Strength · medium
    27 votes
72. Captcha checker "pd-captcha_form_SURVEYID" cookie is accepting any valueImproper Access Control - Generic · medium
    26 votes
73. [intensedebate.com] XSS Reflected POST-Based on update/tumblr2/{$id}Cross-site Scripting (XSS) - Reflected · medium
    25 votes
74. [tumblr.com] 69< Firefox Only XSS ReflectedCross-site Scripting (XSS) - Reflected · medium
    25 votes
75. WordPress core stored XSS via attachment file nameCross-site Scripting (XSS) - Generic
    25 votes
76. Gaining unlimited bonus points on websites with WooCommerce Points and RewardsBusiness Logic Errors · high
    23 votes
77. IDOR at 'media_code' when addings media to questionsInsecure Direct Object Reference (IDOR) · medium
    22 votes
78. Rate Limit Misconfiguration on tumblr login .Improper Authentication - Generic
    21 votes
79. No rate limit on app.crowdsignal.com (Finish quiz)Business Logic Errors · low
    21 votes
80. Stored XSS in learnboost.com via the lesson[goals] parameter.Cross-site Scripting (XSS) - Stored
    21 votes
81. xss filter bypass [polldaddy]Cross-site Scripting (XSS) - Generic
    21 votes
82. [tumblr.com] CSRF in /svc/user/filtered_contentCross-Site Request Forgery (CSRF) · low
    20 votes
83. Reflected XSS on a Atavist themeCross-site Scripting (XSS) - Reflected · medium
    20 votes
84. [Simplenote for Windows] Client RCE via External JavaScript Inclusion leveraging ElectronCode Injection · high
    19 votes
85. Improper markup sanitization.UI Redressing (Clickjacking)
    19 votes
86. Cross Domain leakage of sensitive information - Leading to Account Takeover at Instagram BrandImproper Authentication - Generic · low
    19 votes
87. Akismet API keys are exposed by authentication methodStoring Passwords in a Recoverable Format · low
    17 votes
88. [intensedebate.com] Open RedirectOpen Redirect
    17 votes
89. Denial-of- service By Cache Poisoning The Cross-Origin Resource Sharing Misconfiguration Allow Origin HeaderUncontrolled Resource Consumption · medium
    17 votes
90. Stored XSS in www.learnboost.com via ZIP codes.Cross-site Scripting (XSS) - Stored
    17 votes
91. No Rate Limit on CrowdSignal Polls when Adding CommentBusiness Logic Errors · low
    16 votes
92. Improper markup sanitisation in Simplenote Android application.UI Redressing (Clickjacking)
    16 votes
93. [app.simplenote.com] Stored XSS via Markdown SVG filter bypassCross-site Scripting (XSS) - Stored · medium
    16 votes
94. https://secure.gravatar.commedium
    16 votes
95. WooCommerce: Support Ticket indirect object referenceCross-Site Request Forgery (CSRF)
    16 votes
96. Entering passwords on the Share Login Page can lead to a brute-force attackImproper Restriction of Authentication Attempts · low
    15 votes
97. Ability to subscribe to inactive Post+ creatorsBusiness Logic Errors · low
    15 votes
98. Reflected XSS at /category/ on a Atavis theme Cross-site Scripting (XSS) - Reflected · medium
    15 votes
99. Arbitrary File Download as ShopmanagerPath Traversal · high
    15 votes
100. Multiple File Manipulation bugs in WP Super Cache
     15 votes