Site Kit by Google

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Product vulnerability (Tier OT1; supply-chain compromise is a separate category) │ $101 - $3,133.70 │ $126 - $3,916.70 Other security issue (Tier OT1 flat award) │ $500 │ $625 Submit a vulnerability CVE history 1 Last 12 months 2 Lifetime Access control 35 % XSS 25 % Auth bypass 25 % Info disclosure 10 % Latest advisories Loading the feed Overview Site Kit is Google's own WordPress plugin, the supported way to connect a WordPress site to Analytics, Search Console, AdSense and Tag Manager, and it has been downloaded 269,780,453 times from wordpress.org, which places it among the most-installed plugins in the directory. Two things make a defect here unusually expensive. WordPress plugin vulnerabilities are mass-exploited within days of disclosure, because the attacker's target list is simply every site running the plugin; and Site Kit holds live OAuth tokens for the site owner's Google Analytics, Search Console and AdSense accounts, so a permission-check or token-disclosure bug is a cross-service credential compromise rather than only a WordPress compromise. One CVE in the plugin's whole lifetime against that install base reads as a gap in attention rather than a clean bill of health. Google pays for it on the Bug Hunters open-source VRP, where the repository is rated Tier OT1: a product vulnerability in the plugin's own code pays $101 to $3,133.70 at a panel's discretion, and the $13,337 figure that gets quoted belongs to the separate supply-chain-compromise category covering the repository and the release pipeline. sorona.xyz adds 1.25× on top of whatever Google awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope Google's open-source VRP takes security issues in the latest versions of the code held in the repositories it lists, and google/site-kit-wp is named in the published tier file at TIER_OT1: a product vulnerability anywhere in the plugin's own code is accepted, at $101 to $3,133.70 The whole PHP plugin as it installs on a WordPress site, across every module it ships: Analytics, Search Console, AdSense and Tag Manager, along with the other Google service integrations bundled with it Authentication and credentials: the OAuth flow that connects a site to those services, the client half of the proxy sign-in handshake with sitekit.withgoogle.com , and the storage, refresh, scoping and revocation of the tokens it receives Every REST route the plugin registers, the permission_callback on each one, and the data those routes return The admin surfaces: nonce verification, capability checks, the settings and module activation flows, and the user and site option storage behind them The React dashboard rendered inside wp-admin, its data fetching, and any markup it produces from an API response The tags and snippets the plugin injects into rendered pages, and the placement logic deciding when they appear Plugin update and release publishing to wordpress.org, which Google prices under its separate supply-chain category Out of scope WordPress core vulnerabilities, which belong to WordPress rather than to the plugin Other plugins and themes installed alongside Site Kit, including interactions that only misbehave because of what the other plugin does The hosted sitekit.withgoogle.com service itself, which is a Google web property under the main Google VRP rather than the open-source program Issues that require an administrator account acting against their own site, since an administrator already holds the capability being bypassed Site-owner misconfiguration of Google service permissions, which is a setup mistake rather than a plugin defect Repositories in Google's GitHub orgs that the tier file does not list, which pay nothing for a product vulnerability after the April 2026 rules update Defects that only reproduce on a plugin release wordpress.org no longer carries, since the program covers the latest versions Reports filed by anyone other than the finder: Google wants the submission through bughunters.google.com under the researcher's own identity, and it does not pay Google or Google Partner employees Rewards to researchers on a sanctions list, in a sanctioned territory, or located in Russia or Belarus, which Google states it cannot issue Most-valued findings A REST route with a missing or weak permission_callback that reaches the stored Google OAuth tokens: access control is 35% of the recorded distribution here, and token disclosure is the one class that turns a WordPress bug into an Analytics, Search Console and AdSense compromise at once Authentication bypass in the proxy sign-in handshake that lets a request be treated as the site's connected owner, at 25% and the highest-impact auth shape the plugin exposes Stored XSS in the dashboard or in injected tag output that fires in an administrator's session, the shape of the plugin's single existing CVE and 25% of the distribution A missing nonce or capability check on an admin action, which turns one crafted link into a settings change or a re-authorisation of the site against an attacker-controlled Google account Anything that works on a stock install with default Google service permissions, because a plugin flaw is only mass-exploitable when it needs no unusual configuration, and that is what the panel prices Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. The repo is rated TIER_OT1, where a product vulnerability caps at $3,133.70; the $13,337 ceiling requires a supply-chain compromise of the repository or release pipeline, which is a different reward category The hosted sitekit.withgoogle.com service is out of scope for the open-source VRP and belongs to the main Google VRP: the plugin's side of that handshake is what qualifies here The award is set by a discretionary panel, so the band is a range rather than a fixed table and a report that spells out real impact on a default install is what moves you up it The defect has to live in the plugin: WordPress core, and anything another plugin or theme on the same site does, is somebody else's program Take the flaw to Google before anyone else: the VRP treats private disclosure to a third party for purposes other than fixing the bug as grounds to refuse the reward Disclosure Coordinated through Google Bug Hunters, with the fix shipping as a new plugin release on wordpress.org. Because the program's rules can be read as barring a third-party hand-off before the fix, file with Google directly and hold the detail until the release has propagated: WordPress plugin flaws are weaponised within days of a public writeup, and the auto-update wave needs the lead time. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability