Browse / WordPress

WordPress

See its reports on the map

What gets reported to WordPress

• Cross-site Scripting39
• Access Control16
• Misconfiguration11
• Information Disclosure8
• Cross-Site Request Forgery6
• Path Traversal3

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Stored XSS VulnerabilityCross-site Scripting (XSS) - Stored · high
   403 votes
2. Stored XSS in Private Message component (BuddyPress)Cross-site Scripting (XSS) - Stored · critical
   337 votes
3. RCE as Admin defeats WordPress hardening and file permissionsPath Traversal · critical
   164 votes
4. Stored XSS on byddypress Plug-in via groups nameCross-site Scripting (XSS) - Stored · low
   132 votes
5. Wordpress unzip_file path traversalViolation of Secure Design Principles · medium
   119 votes
6. Reflected XSS on https://make.wordpress.org via 'channel' parameterCross-site Scripting (XSS) - Reflected · high
   97 votes
7. CSRF to HTML Injection in CommentsCross-Site Request Forgery (CSRF) · high
   95 votes
8. Privilege Escalation via REST API to Administrator leads to RCEPrivilege Escalation · high
   92 votes
9. Clickjacking on donation pageUI Redressing (Clickjacking) · low
   90 votes
10. Potential unprivileged Stored XSS through wp_targeted_link_relCross-site Scripting (XSS) - Stored · high
    80 votes
11. Unauthenticated WordPress Database Repair DoSN/AUncontrolled Resource Consumption · high
    70 votes
12. Mssing Authorization on Private Message replies (BuddyPress)Improper Access Control - Generic · low
    66 votes
13. Pivilege escalation of any new user to Keymaster caused by CSRFPrivilege Escalation · medium
    61 votes
14. plugins.trac.wordpress.org likely vulnerable to Cross Site Tracing (xst), TRACE HTTP method should be disabledViolation of Secure Design Principles
    58 votes
15. Unauthenticated disclosure of draft/private/pending post titles & IDs via Secure Custom Fields nopriv AJAX field-query handlers (post_object/relationsImproper Access Control - Generic · medium
    51 votes
16. wp-embed XSS on SafariCross-site Scripting (XSS) - DOM · medium
    49 votes
17. Author → arbitrary file deletion anywhere on disk (site takeover) via `POST /wp/v2/media/<id>/finalize` poisoning `_wp_attachment_metadata`Path Traversal · critical
    48 votes
18. Authenticated XXEXML External Entities (XXE) · medium
    41 votes
19. Logic flaw in the Post creation process allows creating posts with arbitrary types without needing the corresponding nonceBusiness Logic Errors · high
    38 votes
20. WordPress 7.1 Media Processing Race Enables Persistent PHP File Write and Author-to-RCECode Injection · high
    37 votes
21. CampTix [camptix_private]: the view token is derived from the requester's own IP, so naming any attendee's e-mail unlocks the gated contentImproper Authentication - Generic · medium
    36 votes
22. Multiple stored XSS in WordPressCross-site Scripting (XSS) - Stored
    35 votes
23. "Bad Protocols Validation" Bypass in "wp_kses_bad_protocol_once" using HTML-encoding without trailing semicolonsCross-site Scripting (XSS) - Generic · medium
    34 votes
24. Author → stored XSS in wp-admin: unescaped sub-size filename from attachment metadata breaks out of the `src` attribute in `get_media_item()`Cross-site Scripting (XSS) - Stored · critical
    32 votes
25. Add users to groups who have restricted group invitesImproper Access Control - Generic · high
    32 votes
26. Information / sensitive data disclosure on some endpointsInformation Disclosure · medium
    32 votes
27. wordpress.org/openverse/: unauthenticated open redirect — `str_replace()`'s 4th arg is a count, not a limit; bypasses WordPress.org SSO allow-listOpen Redirect · medium
    31 votes
28. [mercantile.wordpress.org] Reflected XSS via AngularJS Template InjectionCross-site Scripting (XSS) - Reflected · medium
    29 votes
29. Unauthenticated Disclosure of Private, Draft, and Password-Protected Post Content via Core Read-Permission Bypass in SCF Reference FieldsInformation Disclosure · high
    27 votes
30. Information Disclosure - Unauthen Leak Private ContentInformation Disclosure · medium
    27 votes
31. Open API For Username enumerationN/AInformation Disclosure · low
    25 votes
32. wordpress.org Rosetta: invite stores unvalidated role — Editor can assign site Administrator despite editable_rolesImproper Access Control - Generic · high
    24 votes
33. Authenticated Stored Cross-site Scripting in bbPressCross-site Scripting (XSS) - Stored · medium
    24 votes
34. WordCamp Meta gpre: password-protected event RSVP list readable without password via /gpre/v1/.../rsvp-responsesImproper Access Control - Generic · medium
    23 votes
35. Unauthenticated disclosure of private and hidden forum content in bbPress via the WordPress core REST single-item endpointImproper Access Control - Generic · critical
    23 votes
36. Open Email Relay on WordPress Gutenberg Plugin via formAction parameter leads to phishing and spam campaignsViolation of Secure Design Principles
    23 votes
37. Stored XSS on Broken Themes via filenameCross-site Scripting (XSS) - Stored · low
    23 votes
38. Wordpress 4.7.2 - Two XSS in Media Upload when file too large.Cross-site Scripting (XSS) - Generic · high
    23 votes
39. XSS via unicode characters in upload filenameCross-site Scripting (XSS) - Generic · medium
    23 votes
40. Content Spoofing @ https://irclogs.wordpress.org/Improper Access Control - Generic · low
    22 votes
41. Arbitrary change of blog's background image via CSRFCross-Site Request Forgery (CSRF) · medium
    21 votes
42. Reflected Swf XSS In ( plugins.svn.wordpress.org )Cross-site Scripting (XSS) - Reflected · medium
    21 votes
43. DOM Based XSS In mercantile.wordpress.orgCross-site Scripting (XSS) - DOM · medium
    21 votes
44. Infrastructure - Photon - SSRFServer-Side Request Forgery (SSRF) · medium
    21 votes
45. Wordpress 4.7 - CSRF -> HTTP SSRF any private ip:port and basic-authCross-Site Request Forgery (CSRF) · high
    21 votes
46. Large-site Quick Edit reparses a Contributor display name into active HTMLCross-site Scripting (XSS) - DOM · medium
    20 votes
47. [FG-VD-18-165] Wordpress Cross-Site Scripting Vulnerability Notification IICross-site Scripting (XSS) - Stored · medium
    20 votes
48. XSS in the search bar of mercantile.wordpress.orgCross-site Scripting (XSS) - Reflected · medium
    19 votes
49. Instamojo CampTix: fail-open MAC + webhook Credit without binding payment to orderImproper Access Control - Generic · high
    17 votes
50. PII of users can be downloaded from export pagesInformation Disclosure · medium
    17 votes
51. Arbitrary file deletion in wp-core - guides towards RCE and information disclosurePath Traversal · critical
    17 votes
52. WordPress DB Class, bad implementation of prepare method guides to sqli and information disclosureSQL Injection · critical
    17 votes
53. Unauthenticated private CSV export of Meetup organizer PII via broken authz check in WordCamp ReportsImproper Access Control - Generic · high
    16 votes
54. Clickjacking In jobs.wordpress.netUI Redressing (Clickjacking) · low
    16 votes
55. Reflected XSS at https://da.wordpress.org/themes/?s= via "s=" parameter Cross-site Scripting (XSS) - Reflected · medium
    16 votes
56. Reflected XSS: Taxonomy Converter via tax parameterCross-site Scripting (XSS) - Reflected · medium
    15 votes
57. Stored self-XSS in mercantile.wordpress.org checkoutCross-site Scripting (XSS) - Stored · low
    15 votes
58. Authenticated Cross-site Scripting in Template NameCross-site Scripting (XSS) - Stored · medium
    15 votes
59. CSRF to add admin [wordpress]Cross-Site Request Forgery (CSRF)
    15 votes
60. Stored XSS in Post Preview as ContributorCross-site Scripting (XSS) - Stored · medium
    14 votes
61. Open Redirect on the nl.wordpress.netOpen Redirect · low
    14 votes
62. Buddypress 2.9.1 - Exceeding the maximum upload size - XSS leading to potential RCE. Cross-site Scripting (XSS) - Generic · medium
    14 votes
63. Clickjacking wordcamp.orgUI Redressing (Clickjacking) · low
    14 votes
64. Stored XSS in the Classic block element pathCross-site Scripting (XSS) - Stored
    13 votes
65. [mercantile.wordpress.org] Reflected XSSCross-site Scripting (XSS) - Reflected · medium
    13 votes
66. Missing SSL can leak job token Cleartext Transmission of Sensitive Information · low
    13 votes
67. Improper Access Control in Buddypress core allows reply,delete any user's activityImproper Access Control - Generic · medium
    12 votes
68. pre-auth Stored XSS in comments via javascript: url when administrator edits user supplied commentCross-site Scripting (XSS) - Stored · high
    12 votes
69. [support.wordcamp.org] - publicly accessible .svn repositoryImproper Access Control - Generic
    12 votes
70. Clickjacking mercantile.wordpress.orgUI Redressing (Clickjacking) · low
    12 votes
71. Stored xss via template injectionCross-site Scripting (XSS) - Stored · high
    12 votes
72. Lack of Sanitization and Insufficient AuthenticationCross-site Scripting (XSS) - Stored · medium
    11 votes
73. DOM-based XSS in playground.wordpress.net (/scope:*/wp-includes/empty.html) lets any attacker run JavaScript on the origin via a single crafted linkCross-site Scripting (XSS) - DOM · low
    10 votes
74. xss - reflectedCross-site Scripting (XSS) - Reflected · low
    10 votes
75. Stored XSS on Wordpress 5.3 via Title PostN/ACross-site Scripting (XSS) - Stored · high
    9 votes
76. Parameter tampering : Price Manipulation of ProductsDuplicateBusiness Logic Errors
    9 votes
77. XSS on support.wordcamp.org in ajax-quote.phpCross-site Scripting (XSS) - Reflected
    9 votes
78. MediaElements XSSCross-site Scripting (XSS) - Reflected · high
    9 votes
79. code.wordpress.net subdomain TakeoverMisconfiguration · medium
    9 votes
80. [Buddypress] Arbitrary File Deletion through bp_avatar_sethigh
    9 votes
81. Allow authenticated users can edit, trash,and add new in BuddyPress Emails functionPrivilege Escalation · medium
    8 votes
82. Account takeover vulnerability by editor role privileged users/attackers via clickjackingN/AUI Redressing (Clickjacking) · high
    8 votes
83. Clickjacking - https://mercantile.wordpress.org/UI Redressing (Clickjacking) · low
    8 votes
84. Self-XSS in WordPress Editor Link ModalCross-site Scripting (XSS) - Generic · low
    8 votes
85. Stored but [SELF] XSS in mercantile.wordpress.orgCross-site Scripting (XSS) - Stored · low
    8 votes
86. [BuddyPress 2.9.1] Open Redirect via "wp_http_referer" parameter on "bp-profile-edit" endpointOpen Redirect · low
    7 votes
87. Lack of Password Confirmation when Changing Password and EmailDuplicateImproper Authentication - Generic
    7 votes
88. Privilege Escalation in BuddyPress core allows Moderate to Administrator Privilege Escalation · medium
    6 votes
89. Unauthenticated hidden groups disclosure via Ajax groups searchImproper Access Control - Generic · medium
    6 votes
90. WordPress core - Denial of Service via Cross Site Request ForgeryUncontrolled Resource Consumption
    6 votes
91. CSRF on comment postN/ACross-Site Request Forgery (CSRF) · medium
    5 votes
92. CSRF in Profile Fields allows deleting any field in BuddyPressCross-Site Request Forgery (CSRF) · medium
    5 votes
93. Wordpress 4.8.1 - Rogue editor leads to RCE. And the risks of same origin frame scripting in generalInformativeCode Injection · high
    4 votes
94. Administrator(s) Information disclosure via JSON on wordpress.orgN/AInformation Disclosure · medium
    4 votes
95. antispambot does not always escape <, >, &, " and 'InformativeCross-site Scripting (XSS) - Generic · low
    3 votes
96. Stored XSS in WordPressInformativeCross-site Scripting (XSS) - Stored · medium
    3 votes
97. Clickjacking irclogs.wordpress.orgInformativeUI Redressing (Clickjacking)
    2 votes
98. WordPress Automatic Update Protocol Does Not Authenticate Updates Provided by the ServerN/ACryptographic Issues - Generic · high
    2 votes
99. UnResolved ChangeSet are Visible to Public That also Causes Information DisclosureInformativeInformation Disclosure
    1 votes