Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Automattic bug bounty programs

automattic.com Updated

Automattic runs one public program: a HackerOne bug bounty.

Top reward
Not published
Programs
1
1 pays cash
Targets in scope
30
6 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program Automattic runs.

  • Automattic

    HackerOne · Bug bounty

    Open

    Top reward

    Not published
    Critical
    $1,000
    High
    $600
    Medium
    $300
    Low
    $100

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

30 targets. 20 excluded.

  • *.srvcs.tumblr.com

    Wildcards Critical

  • *.tumblr.com

    Wildcards Critical

  • akismet.com

    Web Critical

  • api.tumblr.com

    Web Critical

  • assets.tumblr.com

    Web Critical

  • clay.earth

    Web High

  • embed.tumblr.com

    Web Critical

  • gravatar.com

    Web High

  • intensedebate.com

    Web Medium

  • mailpoet.com

    Web Critical

  • my.pressable.com

    Web Critical

  • parse.ly

    Web Critical

  • safe.tumblr.com

    Web Critical

  • secure.tumblr.com

    Web Critical

  • simperium.com

    Web High

  • simplenote.com

    Web High

  • t.umblr.com

    Web Critical

  • wordpress.com

    Web Critical

  • wpscan.com

    Web High

  • www.tumblr.com

    Web Critical

  • com.tumblr

    Android High

  • com.clay.ios

    iOS High

  • com.tumblr.tumblr

    iOS High

  • Jetpack

    Source code Critical

  • Beeper

    Products and areas High

No target matches. Try part of a host name, such as the company name.

Out of scope 20

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • *.afterthedeadline.com

  • afterthedeadline.com

  • afterthedeadline.com,*.afterthedeadline.com

  • *.crowdsignal.net

  • *.learnboost.com

  • learnboost.com

  • learnboost.com,*.learnboost.com

  • *.polishmywriting.com

  • polishmywriting.com

  • polishmywriting.com,*.polishmywriting.com

  • *.poll.fm

  • *.scrollkit.com

  • scrollkit.com

  • scrollkit.com,*.scrollkit.com

  • *.survey.fm

  • *.txmblr.com

  • atavist.com

  • happy.tools

  • try.pressable.com

  • */xmlrpc.php

Recent changes

Reward and scope changes across every Automattic program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in Automattic products, from the NVD.

Search NVD
  • CVE-2026-4338 High

    The ActivityPub WordPress plugin before 8.0.2 does not properly filter posts to be displayed, allowed unauthenticated users to access drafts/scheduled/pending posts

  • CVE-2023-54332 Medium

    Jetpack 11.4 contains a cross-site scripting vulnerability in the contact form module that allows attackers to inject malicious scripts through the post_id parameter. Attackers can craft malicious URLs with script payloads to execute arbitrary JavaScript in victims' browsers when they interact with the contact form page.

  • CVE-2024-8009 Medium

    The Sensei LMS WordPress plugin before 4.20.0 disclose all users of the blog including their email address to teachers on the students page

  • CVE-2024-6584 Critical

    The 'wp_ajax_boost_proxy_ig' action allows administrators to make GET requests to arbitrary URLs.

  • CVE-2024-12743 Medium

    The MailPoet WordPress plugin before 5.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

  • CVE-2024-10076 Medium

    The Jetpack WordPress plugin before 13.8, Jetpack Boost WordPress plugin before 3.4.8 use regexes in the Site Accelerator features when switching image URLs to their CDN counterpart. Unfortunately, some of them may match patterns it shouldn’t, ultimately making it possible for contributor and above users to perform Stored XSS attacks

  • CVE-2024-10075 Medium

    The Jetpack WordPress plugin before 13.8 does not ensure that the post created by the Contact Form is only accessible to authorised users, which could allow unauthenticated users to run arbitrary shortcodes and block.

  • CVE-2025-0466 Medium

    The Sensei LMS WordPress plugin before 4.24.4 does not properly protect some its REST API routes, allowing unauthenticated attackers to leak sensei_email and sensei_message Information.

About this page

This page gathers every public program listed under automattic.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.