- Top reward
- Not published
- Top severity paid
- Not published
- Assets in scope
- 46
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays cash
- Amounts are not published; ask before you invest time.
- Report by email
- [email protected]
- Partial safe harbor
- Some legal protection; read the terms.
- Replies within 3 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
The policy page has no reward table. Here is what it says, in its own words.
- Pays cash
-
Yes
We offer a bounty for reporting security vulnerabilities that substantially impact the integrity and confidentiality of user data in our hosting environment.
- Response
-
Within 3 days
If you do not receive a response from us within 72 hours, please follow up to ensure we received your report.
- Safe harbor
-
Partial
Under no circumstances should your testing and reporting of a security vulnerability affect the availability of Liquid Web’s services, violate Liquid Web’s terms of service , or disrupt or compromise any data that is not your own.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
46 assets you may test, 17 excluded.
Domains 32
- api.liquidweb.com
- cart.liquidweb.com
- demos.iconicwp.com
- fluxcheckout.com
- forums.interworx.com
- futurehosting.com
- givewp.com
- iconicwp.com
- interworx.com
- ithemes.liquidweb.com
- learndash.com
- liquidweb.com
- login.liquidweb.com
- manage.liquidweb.com
- my.futurehosting.com
- my.orderable.com
- nexcess.com
- nexcess.net
- nocworx.nexcess.net
- ns1.liquidweb.com
- ns.liquidweb.com
- orderable.com
- order.nexcess.net
- portal.interworx.com
- portal.nexcess.net
- promoter.theeventscalendar.com
- stellarwp.com
- support.interworx.com
- support.learndash.com
- theeventscalendar.com
- wpbusinessreviews.com
- www.liquidweb.com
Source code 3
- applications hosted on Liquid Web’s GitHub
- applications hosted on Nexcess’ GitHub
- Applications hosted on the-events-calendar’s GitHub
Wildcard domains 1
- *.ithemes.liquidweb.com
Products and areas 10
- All WordPress plugins
- BackupBuddy
- iThemes Security Pro
- iThemes Sync
- Kadence WP
- Liquid Web email servers
- Liquid Web’s Managed WordPress environment
- Nexcess Cloud Managed Environment
- Nodeworx and siteworx
- Restrict Content Pro
Out of scope (17)
- 0day exploits unless the product is made by Liquid Web brands.
- Clickjacking that does not exist in our in-scope pages.
- Configuration and best practices such as SPF/DMARC, missing security headers including CSP, or insecure SSL/TLS ciphers that do not lead to an exploit.
- Cross domain leakage.
- Demo and testing sites.
- Discourse
- Email and account policies such as reset method and password complexity.
- Exploits that require physical access to victim’s device.
- Happyfox
- High severity CVE’s within the last 6 months.
- Information disclosure such as software version, file path, email or IP addresses.
- Lack of Secure/HTTPOnly flags and CSRF tokens on non-sensitive pages (anonymous form or logout page).
- Open redirects, unless the impact is high.
- PoC that solely rely on DNS lookup or HTTP request from tools such as Burp collaborator or webhook.site.
- Salesforce
- Theoretical XSS or Self-XSS attacks without evidence of exploitability, such as input being reflected in response.
- Third-party software such as Salesforce, Discourse, Happyfox, or WordPress core.
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Liquid Web's policy. "We" in these lines means the program, not this site.
While testing
-
Do not leave any system in an unusable state.
-
Do not test any domain or subdomains not listed above unless authorized.
-
Do not perform denial of service attacks including testing of rate limits and brute force.
-
Do not perform physical attacks against our offices and data centers.
-
Do not perform social engineering of our service desk, employees or contractors.
-
Do not compromise our users and employee accounts, including interacting with accounts you do not own.
-
Do not exfiltrate any data.
-
Do not mass create accounts or services.
-
Automated scanning tools such as Burp, Zap, Nessus, OpenVAS etc. are allowed. However, we do not accept reports generated from scanning tools.
-
Please make sure to redact private and identifiable information such as credit card number, password, address etc.
Not accepted
-
Third-party software such as Salesforce, Discourse, Happyfox, or WordPress core.
-
High severity CVE’s within the last 6 months.
-
0day exploits unless the product is made by Liquid Web brands.
-
Configuration and best practices such as SPF/DMARC, missing security headers including CSP, or insecure SSL/TLS ciphers that do not lead to an exploit.
-
Information disclosure such as software version, file path, email or IP addresses.
-
PoC that solely rely on DNS lookup or HTTP request from tools such as Burp collaborator or webhook.site.
-
Lack of Secure/HTTPOnly flags and CSRF tokens on non-sensitive pages (anonymous form or logout page).
-
Clickjacking that does not exist in our in-scope pages.
-
Cross domain leakage.
-
Open redirects, unless the impact is high.
-
Email and account policies such as reset method and password complexity.
-
Theoretical XSS or Self-XSS attacks without evidence of exploitability, such as input being reflected in response.
-
Exploits that require physical access to victim’s device.
-
Demo and testing sites.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.