- Top reward
- Not published
- Top severity paid
- Critical
- Assets in scope
- 30
- Public CVEs
- 60
- Last change
At a glance
What to know before you start testing.
- Pays cash
- Amounts are not published; ask before you invest time.
- Report on HackerOne
- Submit through the program page.
- No public write-ups
- Keep findings private.
Rewards
What HackerOne lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$1,000 |
| High |
|
$600 |
| Medium |
|
$300 |
| Low |
|
$100 |
- Top reward
-
$1,000
Critical | $1,000 | $500
- Lowest reward
-
$100
Low | $100 | $100
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
30 assets you may test, 20 excluded.
Web 18
- akismet.com Critical
- api.tumblr.com Critical
- assets.tumblr.com Critical
- clay.earth High
- embed.tumblr.com Critical
- gravatar.com High
- intensedebate.com Medium
- mailpoet.com Critical
- my.pressable.com Critical
- parse.ly Critical
- safe.tumblr.com Critical
- secure.tumblr.com Critical
- simperium.com High
- simplenote.com High
- t.umblr.com Critical
- wordpress.com Critical
- wpscan.com High
- www.tumblr.com Critical
iOS apps 2
- com.clay.ios High
- com.tumblr.tumblr High
Wildcard domains 2
- *.srvcs.tumblr.com Critical
- *.tumblr.com Critical
Android apps 1
- com.tumblr High
Source code 1
- Jetpack Critical
Products and areas 6
- Beeper High
- Crowdsignal Critical
- WooCommerce Critical
- WordPress Plugins & Themes Critical
- WordPress VIP Critical
- WP Cloud Critical
Out of scope (20)
- */xmlrpc.php
- atavist.com
- happy.tools
- try.pressable.com
- *.afterthedeadline.com
- afterthedeadline.com
- afterthedeadline.com,*.afterthedeadline.com
- *.crowdsignal.net
- *.learnboost.com
- learnboost.com
- learnboost.com,*.learnboost.com
- *.polishmywriting.com
- polishmywriting.com
- polishmywriting.com,*.polishmywriting.com
- *.poll.fm
- *.scrollkit.com
- scrollkit.com
- scrollkit.com,*.scrollkit.com
- *.survey.fm
- *.txmblr.com
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Automattic (via HackerOne)'s policy.
While testing
-
Access to, or modification of user data is explicitly prohibited without prior consent from the account owner
-
All supporting evidence and other attachments must be stored only within the report you submit
-
Do not host any files on external services
-
please allow Automattic sufficient time to patch other host instances
-
file it within the existing report
Not accepted
-
Broken access control
-
DoS vulnerabilities that are perceived by a lack of rate-limiting or captcha
-
Tabnabbing vulnerabilities
-
Missing Best Practices that don't pose a direct security threat
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope removed
Texts
-
Rules updated
Added: “…lves trust, unless they demonstrate a high severity impact. Most of the authenticated issues will only be eligible for rep points. For example, a clear path to...”
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-4338 | The ActivityPub WordPress plugin before 8.0.2 does not properly filter posts to be displayed, allowed unauthenticated users to access drafts/scheduled/pending posts | High 7.5 | 8 Apr 2026 |
| CVE-2023-54332 | Jetpack 11.4 contains a cross-site scripting vulnerability in the contact form module that allows attackers to inject malicious scripts through the post_id parameter. Attackers can craft malicious URLs with script payloads to execute arbitrary JavaScript in victims' browsers when they interact with the contact form page. | Medium 5.1 | 13 Jan 2026 |
| CVE-2024-8009 | The Sensei LMS WordPress plugin before 4.20.0 disclose all users of the blog including their email address to teachers on the students page | Medium 4.3 | 15 May 2025 |
| CVE-2024-6584 | The 'wp_ajax_boost_proxy_ig' action allows administrators to make GET requests to arbitrary URLs. | Critical 9.1 | 15 May 2025 |
| CVE-2024-12743 | The MailPoet WordPress plugin before 5.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | Medium 4.8 | 15 May 2025 |
| CVE-2024-10076 | The Jetpack WordPress plugin before 13.8, Jetpack Boost WordPress plugin before 3.4.8 use regexes in the Site Accelerator features when switching image URLs to their CDN counterpart. Unfortunately, some of them may match patterns it shouldn’t, ultimately making it possible for contributor and above users to perform Stored XSS attacks | Medium 5.9 | 15 May 2025 |
| CVE-2024-10075 | The Jetpack WordPress plugin before 13.8 does not ensure that the post created by the Contact Form is only accessible to authorised users, which could allow unauthenticated users to run arbitrary shortcodes and block. | Medium 5.6 | 15 May 2025 |
| CVE-2025-0466 | The Sensei LMS WordPress plugin before 4.24.4 does not properly protect some its REST API routes, allowing unauthenticated attackers to leak sensei_email and sensei_message Information. | Medium 5.3 | 4 Feb 2025 |
| CVE-2024-10858 | The Jetpack WordPress plugin before 14.1 does not properly checks the postmessage origin in its 13.x versions, allowing it to be bypassed and leading to DOM-XSS. The issue only affects websites hosted on WordPress.com. | Medium 6.1 | 25 Dec 2024 |
| CVE-2024-10103 | In the process of testing the MailPoet WordPress plugin before 5.3.2, a vulnerability was found that allows you to implement Stored XSS on behalf of the editor by embedding malicious script, which entails account takeover backdoor | Medium 6.1 | 19 Nov 2024 |
| CVE-2024-9926 | The Jetpack WordPress plugin does not have proper authorisation in one of its REST endpoint, allowing any authenticated users, such as subscriber to read arbitrary feedbacks data sent via the Jetpack Contact Form | Medium 4.3 | 7 Nov 2024 |
| CVE-2024-43968 | Broken Access Control vulnerability in Automattic Newspack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Newspack: from n/a through 3.8.6. | Medium 4.3 | 1 Nov 2024 |
| CVE-2024-7786 | The Sensei LMS WordPress plugin before 4.24.2 does not properly protect some its REST API routes, allowing unauthenticated attackers to leak email templates. | Medium 5.3 | 4 Sep 2024 |
| CVE-2024-43949 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Automattic GHActivity allows Stored XSS.This issue affects GHActivity: from n/a through 2.0.0-alpha. | Medium 6.5 | 29 Aug 2024 |
| CVE-2024-37474 | Cross Site Scripting (XSS) vulnerability in Automattic Newspack Ads allows Stored XSS.This issue affects Newspack Ads: from n/a through 1.47.1. | Medium 6.5 | 4 Jul 2024 |
| CVE-2024-37476 | Cross Site Scripting (XSS) vulnerability in Automattic Newspack Campaigns allows Stored XSS.This issue affects Newspack Campaigns: from n/a through 2.31.1. | Medium 6.5 | 4 Jul 2024 |
| CVE-2023-47788 | Missing Authorization vulnerability in Automattic Jetpack.This issue affects Jetpack: from n/a before 12.7. | Medium 4.3 | 19 Jun 2024 |
| CVE-2024-4392 | The Jetpack – WP Security, Backup, Speed, & Growth plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpvideo shortcode in all versions up to, and including, 13.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary we | Medium 6.4 | 14 May 2024 |
| CVE-2023-47774 | Improper Restriction of Rendered UI Layers or Frames vulnerability in Automattic Jetpack allows Clickjacking.This issue affects Jetpack: from n/a before 12.7. | Medium 5.4 | 24 Apr 2024 |
| CVE-2024-1310 | The WooCommerce WordPress plugin before 8.6 does not prevent users with at least the contributor role from leaking products they shouldn't have access to. (e.g. private, draft and trashed products) | Medium 4.9 | 15 Apr 2024 |
| CVE-2023-51489 | Cross-Site Request Forgery (CSRF) vulnerability in Automattic, Inc. Crowdsignal Dashboard – Polls, Surveys & more.This issue affects Crowdsignal Dashboard – Polls, Surveys & more: from n/a through 3.0.11. | Medium 5.4 | 16 Mar 2024 |
| CVE-2023-50875 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic Sensei LMS – Online Courses, Quizzes, & Learning allows Stored XSS.This issue affects Sensei LMS – Online Courses, Quizzes, & Learning: from n/a through 4.17.0. | Medium 6.5 | 12 Feb 2024 |
| CVE-2023-51488 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic, Inc. Crowdsignal Dashboard – Polls, Surveys & more allows Reflected XSS.This issue affects Crowdsignal Dashboard – Polls, Surveys & more: from n/a through 3.0.11. | High 7.1 | 10 Feb 2024 |
| CVE-2023-51502 | Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce WooCommerce Stripe Payment Gateway.This issue affects WooCommerce Stripe Payment Gateway: from n/a through 7.6.1. | High 7.5 | 5 Jan 2024 |
| CVE-2023-51503 | Authorization Bypass Through User-Controlled Key vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo.This issue affects WooPayments – Fully Integrated Solution Built and Supported by Woo: from n/a through 6.9.2. | Medium 5.9 | 31 Dec 2023 |
| CVE-2023-50879 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WordPress.Com Editing Toolkit allows Stored XSS.This issue affects WordPress.Com Editing Toolkit: from n/a through 3.78784. | Medium 6.5 | 29 Dec 2023 |
| CVE-2023-32747 | Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce WooCommerce Bookings.This issue affects WooCommerce Bookings: from n/a through 1.15.78. | Medium 5.4 | 21 Dec 2023 |
| CVE-2023-35914 | Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce Woo Subscriptions.This issue affects Woo Subscriptions: from n/a through 5.1.2. | High 7.5 | 20 Dec 2023 |
| CVE-2023-35915 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo.This issue affects WooPayments – Fully Integrated Solution Built and Supported by Woo: from n/a through 5.9.0. | High 7.6 | 20 Dec 2023 |
| CVE-2023-35916 | Authorization Bypass Through User-Controlled Key vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo.This issue affects WooPayments – Fully Integrated Solution Built and Supported by Woo: from n/a through 5.9.0. | High 7.5 | 20 Dec 2023 |
| CVE-2023-35876 | Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce WooCommerce Square.This issue affects WooCommerce Square: from n/a through 3.8.1. | High 8.1 | 20 Dec 2023 |
| CVE-2023-37871 | Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce GoCardless.This issue affects GoCardless: from n/a through 2.5.6. | High 8.2 | 20 Dec 2023 |
| CVE-2023-47789 | Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce Canada Post Shipping Method.This issue affects Canada Post Shipping Method: from n/a through 2.8.3. | Medium 4.3 | 18 Dec 2023 |
| CVE-2023-47787 | Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce WooCommerce Bookings.This issue affects WooCommerce Bookings: from n/a through 2.0.3. | Medium 4.3 | 18 Dec 2023 |
| CVE-2023-49828 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo allows Stored XSS.This issue affects WooPayments – Fully Integrated Solution Built and Supported by Woo: from n/a through 6.4.2. | Medium 6.5 | 14 Dec 2023 |
| CVE-2023-47777 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooCommerce, Automattic WooCommerce Blocks allows Stored XSS.This issue affects WooCommerce: from n/a through 8.1.1; WooCommerce Blocks: from n/a through 11.1.1. | Medium 6.5 | 30 Nov 2023 |
| CVE-2023-45050 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic Jetpack – WP Security, Backup, Speed, & Growth allows Stored XSS.This issue affects Jetpack – WP Security, Backup, Speed, & Growth: from n/a through 12.8-a.1. | Medium 6.5 | 30 Nov 2023 |
| CVE-2022-3342 | The Jetpack CRM plugin for WordPress is vulnerable to PHAR deserialization via the ‘zbscrmcsvimpf’ parameter in the 'zeroBSCRM_CSVImporterLitehtml_app' function in versions up to, and including, 5.3.1. While the function performs a nonce check, steps 2 and 3 of the check do not take any action upon a failed check. These steps then perform a 'file_exists' check on the value of 'zbscrmcsvimpf'. If a | High 7.5 | 20 Oct 2023 |
| CVE-2023-5057 | The ActivityPub WordPress plugin before 1.0.0 does not escape user metadata before outputting them in mentions, which could allow users with a role of Contributor and above to perform Stored XSS attacks | Medium 5.4 | 16 Oct 2023 |
| CVE-2023-3707 | The ActivityPub WordPress plugin before 1.0.0 does not ensure that post contents to be displayed are public and belong to the plugin, allowing any authenticated user, such as subscriber to retrieve the content of arbitrary post (such as draft and private) via an IDOR vector. Password protected posts are not affected by this issue. | Medium 4.3 | 16 Oct 2023 |
| CVE-2023-3746 | The ActivityPub WordPress plugin before 1.0.0 does not sanitize and escape some data from post content, which could allow contributor and above role to perform Stored Cross-Site Scripting attacks | Medium 5.4 | 16 Oct 2023 |
| CVE-2023-3706 | The ActivityPub WordPress plugin before 1.0.0 does not ensure that post titles to be displayed are public and belong to the plugin, allowing any authenticated user, such as subscriber to retrieve the title of arbitrary post (such as draft and private) via an IDOR vector | Medium 4.3 | 16 Oct 2023 |
| CVE-2023-2996 | The Jetpack WordPress plugin before 12.1.1 does not validate uploaded files, allowing users with author roles or above to manipulate existing files on the site, deleting arbitrary files, and in rare cases achieve Remote Code Execution via phar deserialization. | High 8.8 | 27 Jun 2023 |
| CVE-2023-27429 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Automattic - Jetpack CRM team Jetpack CRM plugin <= 5.4.4 versions. | Medium 5.9 | 21 Jun 2023 |
| CVE-2014-125104 | A vulnerability was found in VaultPress Plugin up to 1.6.0 on WordPress. It has been declared as critical. Affected by this vulnerability is the function protect_aioseo_ajax of the file class.vaultpress-hotfixes.php of the component MailPoet Plugin. The manipulation leads to unrestricted upload. The attack can be launched remotely. Upgrading to version 1.6.1 is able to address this issue. The patc | Medium 6.3 | 1 Jun 2023 |
| CVE-2023-28121 | An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an unauthenticated attacker to send requests on behalf of an elevated user, like administrator. This allows a remote, unauthenticated attacker to gain admin access on a site that has the affected version of the plugin activated. | Critical 9.8 | 12 Apr 2023 |
| CVE-2022-4497 | The Jetpack CRM WordPress plugin before 5.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins | Medium 5.4 | 9 Jan 2023 |
| CVE-2022-3919 | The Jetpack CRM WordPress plugin before 5.4.3 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. | Medium 4.8 | 12 Dec 2022 |
| CVE-2022-45069 | Auth. (contributor+) Privilege Escalation vulnerability in Crowdsignal Dashboard plugin <= 3.0.9 on WordPress. | Medium 6.3 | 17 Nov 2022 |
| CVE-2022-2034 | The Sensei LMS WordPress plugin before 4.5.0 does not have proper permissions set in one of its REST endpoint, allowing unauthenticated users to access private messages sent to teachers | Medium 5.3 | 29 Aug 2022 |
| CVE-2022-2080 | The Sensei LMS WordPress plugin before 4.5.2 does not ensure that the sender of a private message is either the teacher or the original sender, allowing any authenticated user to send messages to arbitrary private conversation via a IDOR attack. Note: Attackers are not able to see responses/messages between the teacher and student | Medium 4.3 | 29 Aug 2022 |
| CVE-2022-2386 | The Crowdsignal Dashboard WordPress plugin before 3.0.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting | Medium 6.1 | 8 Aug 2022 |
| CVE-2017-20086 | A vulnerability, which was classified as critical, was found in VaultPress Plugin 1.8.4. This affects an unknown part. The manipulation leads to code injection. It is possible to initiate the attack remotely. | Medium 6.3 | 23 Jun 2022 |
| CVE-2021-32789 | woocommerce-gutenberg-products-block is a feature plugin for WooCommerce Gutenberg Blocks. An SQL injection vulnerability impacts all WooCommerce sites running the WooCommerce Blocks feature plugin between version 2.5.0 and prior to version 2.5.16. Via a carefully crafted URL, an exploit can be executed against the `wc/store/products/collection-data?calculate_attribute_counts[][taxonomy]` endpoint | High 7.5 | 26 Jul 2021 |
| CVE-2021-24374 | The Jetpack Carousel module of the JetPack WordPress plugin before 9.8 allows users to create a "carousel" type image gallery and allows users to comment on the images. A security vulnerability was found within the Jetpack Carousel module by nguyenhg_vcs that allowed the comments of non-published page/posts to be leaked. | Medium 5.3 | 21 Jun 2021 |
| CVE-2021-24329 | The WP Super Cache WordPress plugin before 1.7.3 did not properly sanitise its wp_cache_location parameter in its settings, which could lead to a Stored Cross-Site Scripting issue. | Medium 5.4 | 1 Jun 2021 |
| CVE-2021-24312 | The parameters $cache_path, $wp_cache_debug_ip, $wp_super_cache_front_page_text, $cache_scheduled_time, $cached_direct_pages used in the settings of WP Super Cache WordPress plugin before 1.7.3 result in RCE because they allow input of '$' and '\n'. This is due to an incomplete fix of CVE-2021-24209. | High 7.2 | 1 Jun 2021 |
| CVE-2021-24209 | The WP Super Cache WordPress plugin before 1.7.2 was affected by an authenticated (admin+) RCE in the settings page due to input validation failure and weak $cache_path check in the WP Super Cache Settings -> Cache Location option. Direct access to the wp-cache-config.php file is not prohibited, so this vulnerability can be exploited for a web shell injection. | High 7.2 | 5 Apr 2021 |
| CVE-2020-8215 | A buffer overflow is present in canvas version <= 1.6.9, which could lead to a Denial of Service or execution of arbitrary code when it processes a user-provided image. | High 8.8 | 20 Jul 2020 |
| CVE-2019-11843 | The MailPoet plugin before 3.23.2 for WordPress allows remote attackers to inject arbitrary web script or HTML using extra parameters in the URL (Reflective Server-Side XSS). | Medium 6.1 | 2 Jun 2020 |
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Automattic runs WordPress.com, Jetpack, WordPress VIP, Beeper, Akismet, Gravatar, WooCommerce, Tumblr, Simplenote, and more. Find a complete list of projects on our website https://automattic.com/.
Please, report vulnerabilities in the WordPress, BuddyPress, or bbPress open-source projects through the WordPress HackerOne page.
Eligibility and Responsible Disclosure
You are responsible for complying with all applicable laws and must only ever use or otherwise access your own test accounts when researching vulnerabilities in any of our products or services. Access to, or modification of user data is explicitly prohibited without prior consent from the account owner.
Any public disclosure of issues prior to resolution may result in disqualification from the program. Individuals who we are legally prohibited from paying, such as those residing in a country on a U.S. sanctions list, are ineligible for rewards.
Rewards
| Severity | WordPress.com | Everything Else |
|---|---|---|
| Critical | $1,000 | $500 |
| High | $600 | $300 |
| Medium | $300 | $200 |
| Low | $100 | $100 |
The table above outlines the nominal rewards for in-scope assets. Automattic, at its own discretion, will make a final decision on the bounty for qualifying vulnerabilities. Bounties will be awarded to the first reporter of a vulnerability only. If an asset is not in active development, the awards will be adjusted.
Amounts may vary depending upon the severity of the issue and quality of the report.
Crafting a Report
Before submission, please go through the "Non-Qualifying Vulnerabilities" section. If our security team cannot reproduce and verify an issue, a bounty cannot be awarded. To help streamline our intake process, we ask that submissions include:
- Description of the vulnerability
- Steps to reproduce the reported vulnerability
- Proof of exploitability (e.g. screenshot, video)
- Perceived impact to another user or the organization
- Proposed CVSSv3 Vector & Score (without environmental and temporal modifiers)
- List of URLs and affected parameters
- Other vulnerable URLs, additional payloads, Proof-of-Concept code
- Browser, OS and/or app version used during testing
Note: Failure to adhere to these minimum requirements may result in the loss of a reward.
All supporting evidence and other attachments must be stored only within the report you submit. Do not host any files on external services.
Same Bug, Different Host
For each report, please allow Automattic sufficient time to patch other host instances. If you find the same bug on a different (unique) host, prior to the report reaching a triaged state, file it within the existing report. Any reports filed separately while we are actively working to resolve the issue will be treated as a duplicate.
Same Payload, Different Parameter
In some cases, rewards may be consolidated into a single payout. For example, multiple reports of the same vulnerability across different parameters of a resource, or demonstrations of multiple attack vectors against a fundamental framework issue. We kindly ask you to consolidate reports rather than separate them.
Qualifying Vulnerabilities
Any reproducible vulnerability that affects the security of our users is likely to be in scope for the program. Common examples include:
- Cross Site Scripting (XSS)
- Cross Site Request Forgery (CSRF)
- Server Side Request Forgery (SSRF)
- Remote Code Execution (RCE)
- SQL Injection (SQLi)
Non-Qualifying Vulnerabilities (Out of Scope)
In general, issues requiring authenticated roles will not be eligible. This can include Contributor+, Shop Manager+, or basically a role that could only be awarded by an admin and involves trust, unless they demonstrate a high severity impact. Most of the authenticated issues will only be eligible for rep points. For example, a clear path to admin escalation (RCE, SQL injection). "Broken access control” or being able to perform function of another authenticated role is ineligible, unless a chained escalation to critical/high severity is demonstrated.
We would greatly appreciate you focusing on finding high/critical severity issues: Unauthenticated or customer/subscriber+ with an actual security impact, like unauthenticated stored XSS that can run in other visitors’ or admin’s session, bypass paying for products, or RCE as an example.
We are generally not interested in DoS vulnerabilities that are perceived by a lack of rate-limiting or captcha. As a web-scale service, our threshold for rate limiting is higher than you would probably expect. Of course, if you think you have found an exception to this rule, please let us know.
"Follow-Ups" WooCommerce extension is out of scope.
Cross Site Scripting (XSS) is out of scope for all impactless domains where arbitrary HTML / JavaScript is intentionally allowed, e.g. [blog].tumblr.com, cldup.com etc.
Tabnabbing vulnerabilities are out of scope.
Missing Best Practices that don't pose a direct security threat will most likely not be accepted.
Fine Print
You are expected to comply with all applicable laws in connection with your participation in this program and you are responsible for the payment of any taxes associated with rewards received.