- Top reward
- $500
- Top severity paid
- Not published
- Assets in scope
- 1
- Public CVEs
- 3
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $500
- top reward, from $25.
- Report by email
- [email protected]
- Replies within 3 days
- As the policy promises.
Rewards
What the company's own policy page says it pays.
The policy page has no reward table. Here is what it says, in its own words.
- Top reward
-
$500
We may reward those vulnerabilities with proof of compromise with monetary compensation ranging from $25,- to $500,-, depending on the possible impact of the vulnerability.
- Lowest reward
-
$25
We may reward those vulnerabilities with proof of compromise with monetary compensation ranging from $25,- to $500,-, depending on the possible impact of the vulnerability.
- Response
-
Within 3 business days
We will respond to a report within 3 business days with an assessment of the vulnerability and the expected time needed to fix the issue
- Legal protection
-
Stated
If you play by the rules set above when finding security vulnerabilities, we will not pursue any legal action against you regarding the discovery of the vulnerabilities you reported to us.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
1 asset you may test.
Domains 1
- burst-statistics.com
Changes
Tracked since 12 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2024-1894 | The Burst Statistics – Privacy-Friendly Analytics for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'burst_total_pageviews_count' custom meta field in all versions up to, and including, 1.5.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and ab | Medium 6.4 | 13 Mar 2024 |
| CVE-2024-0405 | The Burst Statistics – Privacy-Friendly Analytics for WordPress plugin, version 1.5.3, is vulnerable to Post-Authenticated SQL Injection via multiple JSON parameters in the /wp-json/burst/v1/data/compare endpoint. Affected parameters include 'browser', 'device', 'page_id', 'page_url', 'platform', and 'referrer'. This vulnerability arises due to insufficient escaping of user-supplied parameters and | High 7.2 | 17 Jan 2024 |
| CVE-2023-5761 | The Burst Statistics – Privacy-Friendly Analytics for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'url' parameter in versions 1.4.0 to 1.4.6.1 (free) and versions 1.4.0 to 1.5.0 (pro) due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append addit | Critical 9.8 | 7 Dec 2023 |