- Top reward
- $31,200
- Top severity paid
- Critical
- Assets in scope
- 9
- Public CVEs
- 356
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $31,200
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$1,875 from $1,500 |
| Low |
|
$188 from $150 |
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
9 assets you may test, 7 excluded.
Web 1
- https://wordpress.org
Products and areas 8
- Developer and version-control infrastructure: *.trac.wordpress.org, *.svn.wordpress.org, *.git.wordpress.org, and the repositories under github.com/WordPress
- Related foundation and community domains: wordpressfoundation.org, doaction.org, and gutenberg.run
- The companion projects BuddyPress (buddypress.org and subdomains) and bbPress (bbpress.org), reported alongside Core
- The Gutenberg block editor and the Classic Editor plugin
- WordCamp.org and *.wordcamp.org, plus canonical plugins distributed through WordPress.org
- WordPress Core, its REST API, and the WordPress.org website itself
- WordPress.org infrastructure hosts: api.wordpress.org, profiles.wordpress.org, planet.wordpress.org, codex.wordpress.org, lists.wordpress.org, the *.wordpress.net range, and the wider *.wordpress.org wildcard
- WP-CLI (both the software and its website) and the GlotPress translation platform software (the glotpress.blog site is out of scope)
Out of scope (7)
- Brute-force, denial-of-service, and phishing testing, plus text injection into user-generated wiki, forum, or support content
- Low-impact information leaks, user ID or username enumeration, path disclosure, and software version disclosure
- Missing HTTP security headers with no demonstrated impact, XML-RPC availability reports without proven impact, and unverified automated-scanner output without a working PoC
- Self-XSS in wp-admin that only an already-privileged user can trigger against themselves
- The WordPress mobile apps (Android org.wordpress.android, iOS app id 335703880) and the github.com/wordpress-mobile repositories
- Third-party plugins and themes not maintained by WordPress.org (report those to the Plugin Review team), and non-canonical plugins generally
- WordPress.com and every *.wordpress.com domain, those are Automattic commercial properties handled separately, not this program
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy.
While testing
-
Submit through sorona.xyz first.
-
Only the first reporter of a given vulnerability is eligible for a reward
-
Test against the latest release and include clear, minimal reproduction steps
-
Do not access, modify, or exfiltrate data belonging to other users
-
Submit one distinct issue per report and avoid duplicate filings
-
Keep testing to accounts and instances you control; never target real users
-
Report quality and severity determine the payout amount
Not accepted
-
Self-XSS in wp-admin that only an already-privileged user can trigger against themselves
-
Brute-force, denial-of-service, and phishing testing
-
text injection into user-generated wiki, forum, or support content
-
Low-impact information leaks
-
user ID or username enumeration
-
path disclosure
-
software version disclosure
-
Missing HTTP security headers with no demonstrated impact
-
XML-RPC availability reports without proven impact
-
unverified automated-scanner output without a working PoC
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-119977 | WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window. | High 8.1 | 31 Oct 2026 |
| CVE-2026-87902 | An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE. | High 8.1 | 22 Sep 2026 |
| CVE-2026-60137 | WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter. | Medium 5.9 | 17 Jul 2026 |
| CVE-2026-63030 | WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution. | Critical 9.8 | 17 Jul 2026 |
| CVE-2022-4973 | WordPress Core, in versions up to 6.0.2, is vulnerable to Authenticated Stored Cross-Site Scripting that can be exploited by users with access to the WordPress post and page editor, typically consisting of Authors, Contributors, and Editors making it possible to inject arbitrary web scripts into posts and pages that execute if the the_meta(); function is called on that page. | Medium 4.9 | 16 Oct 2024 |
| CVE-2024-8914 | The Thanh Toán Quét Mã QR Code Tự Động – MoMo, ViettelPay, VNPay và 40 ngân hàng Việt Nam plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.0.1 due to incorrect use of the wp_kses_allowed_html function, which allows the 'onclick' attribute for certain HTML elements without sufficient restriction or context validation. This makes it possible f | High 7.2 | 25 Sep 2024 |
| CVE-2024-4439 | WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. In addition, | High 7.2 | 3 May 2024 |
| CVE-2024-31210 | WordPress is an open publishing platform for the Web. It's possible for a file of a type other than a zip file to be submitted as a new plugin by an administrative user on the Plugins -> Add New -> Upload Plugin screen in WordPress. If FTP credentials are requested for installation (in order to move the file into place outside of the `uploads` directory) then the uploaded file remains temporary av | High 7.6 | 4 Apr 2024 |
| CVE-2024-31211 | WordPress is an open publishing platform for the Web. Unserialization of instances of the `WP_HTML_Token` class allows for code execution via its `__destruct()` magic method. This issue was fixed in WordPress 6.4.2 on December 6th, 2023. Versions prior to 6.4.0 are not affected. | Medium 5.5 | 4 Apr 2024 |
| CVE-2023-5561 | WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack | Medium 5.3 | 16 Oct 2023 |
| CVE-2023-39999 | Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.13, from 6.0 through 6.0.5, from 5.9 through 5.9.7, from 5.8 through 5.8.7, from 5.7 through 5.7.9, from 5.6 through 5.6.11, from 5.5 through 5.5.12, from 5.4 through 5.4.13, from 5.3 through 5.3.15, from 5.2 through 5.2.18, from 5.1 through 5.1.16, from 5.0 th | Medium 4.3 | 13 Oct 2023 |
| CVE-2023-38000 | Auth. Stored (contributor+) Cross-Site Scripting (XSS) vulnerability in WordPress core 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.1.3, from 6.0 through 6.0.5, from 5.9 through 5.9.7 and Gutenberg plugin <= 16.8.0 versions. | Medium 6.5 | 13 Oct 2023 |
| CVE-2013-10027 | A vulnerability was found in Blogger Importer Plugin up to 0.5 on WordPress. It has been classified as problematic. Affected is the function start/restart of the file blogger-importer.php. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. Upgrading to version 0.6 is able to address this issue. The patch is identified as b83fa4f862b0f19a54cfee76060e | Medium 4.3 | 4 Jun 2023 |
| CVE-2022-47174 | Cross-Site Request Forgery (CSRF) vulnerability in WordPress Performance Team Performance Lab plugin <= 2.2.0 versions. | Medium 4.3 | 25 May 2023 |
| CVE-2022-47161 | Cross-Site Request Forgery (CSRF) vulnerability in The WordPress.Org community Health Check & Troubleshooting plugin <= 1.5.1 versions. | Medium 4.3 | 25 May 2023 |
| CVE-2023-2745 | WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter. This allows unauthenticated attackers to access and load arbitrary translation files. In cases where an attacker is able to upload a crafted translation file onto the site, such as via an upload form, this could be also used to perform a Cross-Site Scripting attack. | Medium 5.4 | 17 May 2023 |
| CVE-2013-10021 | A vulnerability was found in dd32 Debug Bar Plugin up to 0.8 on WordPress. It has been declared as problematic. Affected by this vulnerability is the function render of the file panels/class-debug-bar-queries.php. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 0.8.1 is able to address this issue. The patch is named 0842af8f8a556bc3e39b9ef7 | Low 3.5 | 11 Mar 2023 |
| CVE-2023-22622 | WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the source code describes "the scenario where a site may not receive enough visits to execute scheduled tasks in a timely manner," but neither the installation guide nor the security guide mentions this default behavior, or alerts the user about security risks on in | Medium 5.3 | 5 Jan 2023 |
| CVE-2022-3590 | WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden. | Medium 5.9 | 14 Dec 2022 |
| CVE-2022-43500 | Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary script. The developer also provides new patched releases for all versions since 3.7. | Medium 6.1 | 5 Dec 2022 |
| CVE-2022-43504 | Improper authentication vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to obtain the email address of the user who posted a blog using the WordPress Post by Email Feature. The developer also provides new patched releases for all versions since 3.7. | Medium 5.3 | 5 Dec 2022 |
| CVE-2022-43497 | Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary script. The developer also provides new patched releases for all versions since 3.7. | Medium 6.1 | 5 Dec 2022 |
| CVE-2011-1762 | A flaw exists in Wordpress related to the 'wp-admin/press-this.php 'script improperly checking user permissions when publishing posts. This may allow a user with 'Contributor-level' privileges to post as if they had 'publish_posts' permission. | Medium 6.5 | 18 Apr 2022 |
| CVE-2022-21661 | WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to improper sanitization in WP_Query, there can be cases where SQL injection is possible through plugins or themes that use it in a certain way. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. W | High 8.0 | 6 Jan 2022 |
| CVE-2022-21662 | WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Low-privileged authenticated users (like author) in WordPress core are able to execute JavaScript/perform stored XSS attack, which can affect high-privileged users. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go bac | High 8.0 | 6 Jan 2022 |
| CVE-2022-21663 | WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. On a multisite, users with Super Admin role can bypass explicit/additional hardening under certain conditions through object injection. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly re | Medium 6.6 | 6 Jan 2022 |
| CVE-2022-21664 | WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to lack of proper sanitization in one of the classes, there's potential for unintended SQL queries to be executed. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 4.1.34. We strongly recommend that you | High 7.4 | 6 Jan 2022 |
| CVE-2021-44223 | WordPress before 5.8 lacks support for the Update URI plugin header. This makes it easier for remote attackers to execute arbitrary code via a supply-chain attack against WordPress installations that use any plugin for which the slug satisfies the naming constraints of the WordPress.org Plugin Directory but is not yet present in that directory. | High 8.1 | 25 Nov 2021 |
| CVE-2021-39202 | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions the widgets editor introduced in WordPress 5.8 beta 1 has improper handling of HTML input in the Custom HTML feature. This leads to stored XSS in the custom HTML widget. This has been patched in WordPress 5.8. It was only present during the testing/beta pha | High 7.6 | 9 Sep 2021 |
| CVE-2021-39203 | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions authenticated users who don't have permission to view private post types/data can bypass restrictions in the block editor under certain conditions. This affected WordPress 5.8 beta during the testing period. It's fixed in the final 5.8 release. | Medium 6.8 | 9 Sep 2021 |
| CVE-2021-39200 | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions output data of the function wp_die() can be leaked under certain conditions, which can include data like nonces. It can then be used to perform actions on your behalf. This has been patched in WordPress 5.8.1, along with any older affected versions via mino | Medium 5.3 | 9 Sep 2021 |
| CVE-2021-39201 | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. ### Impact The issue allows an authenticated but low-privileged user (like contributor/author) to execute XSS in the editor. This bypasses the restrictions imposed on users who do not have the permission to post `unfiltered_html`. ### Patches This has been patched in WordPress | High 7.6 | 9 Sep 2021 |
| CVE-2020-36326 | PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname. NOTE: this is similar to CVE-2018-19296, but arose because 6.1.8 fixed a functionality problem in which UNC pathnames were always considered unreadable by PHPMailer, even in safe contexts. As an unintended side effect, this fix eliminated the code that blocked addAttachment exp | Critical 9.8 | 28 Apr 2021 |
| CVE-2021-29476 | Requests is a HTTP library written in PHP. Requests mishandles deserialization in FilteredIterator. The issue has been patched and users of `Requests` 1.6.0, 1.6.1 and 1.7.0 should update to version 1.8.0. | Critical 9.8 | 27 Apr 2021 |
| CVE-2021-29450 | Wordpress is an open source CMS. One of the blocks in the WordPress editor can be exploited in a way that exposes password-protected posts and pages. This requires at least contributor privileges. This has been patched in WordPress 5.7.1, along with the older affected versions via minor releases. It's strongly recommended that you keep auto-updates enabled to receive the fix. | Medium 6.5 | 15 Apr 2021 |
| CVE-2021-29447 | Wordpress is an open source CMS. A user with the ability to upload files (like an Author) can exploit an XML parsing issue in the Media Library leading to XXE attacks. This requires WordPress installation to be using PHP 8. Access to internal files is possible in a successful XXE attack. This has been patched in WordPress version 5.7.1, along with the older affected versions via a minor release. W | High 7.1 | 15 Apr 2021 |
| CVE-2020-28032 | WordPress before 5.5.2 mishandles deserialization requests in wp-includes/Requests/Utility/FilteredIterator.php. | Critical 9.8 | 2 Nov 2020 |
| CVE-2020-28033 | WordPress before 5.5.2 mishandles embeds from disabled sites on a multisite network, as demonstrated by allowing a spam embed. | High 7.5 | 2 Nov 2020 |
| CVE-2020-28034 | WordPress before 5.5.2 allows XSS associated with global variables. | Medium 6.1 | 2 Nov 2020 |
| CVE-2020-28035 | WordPress before 5.5.2 allows attackers to gain privileges via XML-RPC. | Critical 9.8 | 2 Nov 2020 |
| CVE-2020-28036 | wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows attackers to gain privileges by using XML-RPC to comment on a post. | Critical 9.8 | 2 Nov 2020 |
| CVE-2020-28037 | is_blog_installed in wp-includes/functions.php in WordPress before 5.5.2 improperly determines whether WordPress is already installed, which might allow an attacker to perform a new installation, leading to remote code execution (as well as a denial of service for the old installation). | Critical 9.8 | 2 Nov 2020 |
| CVE-2020-28038 | WordPress before 5.5.2 allows stored XSS via post slugs. | Medium 6.1 | 2 Nov 2020 |
| CVE-2020-28039 | is_protected_meta in wp-includes/meta.php in WordPress before 5.5.2 allows arbitrary file deletion because it does not properly determine whether a meta key is considered protected. | Critical 9.1 | 2 Nov 2020 |
| CVE-2020-28040 | WordPress before 5.5.2 allows CSRF attacks that change a theme's background image. | Medium 4.3 | 2 Nov 2020 |
| CVE-2020-26596 | The Dynamic OOO widget for the Elementor Pro plugin through 3.0.5 for WordPress allows remote authenticated users to execute arbitrary code because only the Editor role is needed to upload executable PHP code via the PHP Raw snippet. NOTE: this issue can be mitigated by removing the Dynamic OOO widget or by restricting availability of the Editor role. | High 8.8 | 7 Oct 2020 |
| CVE-2020-25286 | In wp-includes/comment-template.php in WordPress before 5.4.2, comments from a post or page could sometimes be seen in the latest comments even if the post or page was not public. | Medium 5.3 | 13 Sep 2020 |
| CVE-2020-4047 | In affected versions of WordPress, authenticated users with upload permissions (like authors) are able to inject JavaScript into some media file attachment pages in a certain way. This can lead to script execution in the context of a higher privileged user when the file is viewed by them. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5 | Medium 6.8 | 12 Jun 2020 |
| CVE-2020-4048 | In affected versions of WordPress, due to an issue in wp_validate_redirect() and URL sanitization, an arbitrary external link can be crafted leading to unintended/open redirect when clicked. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, | Medium 5.7 | 12 Jun 2020 |
| CVE-2020-4049 | In affected versions of WordPress, when uploading themes, the name of the theme folder can be crafted in a way that could lead to JavaScript execution in /wp-admin on the themes page. This does require an admin to upload the theme, and is low severity self-XSS. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, | Low 2.4 | 12 Jun 2020 |
| CVE-2020-4050 | In affected versions of WordPress, misuse of the `set-screen-option` filter's return value allows arbitrary user meta fields to be saved. It does require an admin to install a plugin that would misuse the filter. Once installed, it can be leveraged by low privileged users. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1 | Low 3.5 | 12 Jun 2020 |
| CVE-2020-4046 | In affected versions of WordPress, users with low privileges (like contributors and authors) can use the embed block in a certain way to inject unfiltered HTML in the block editor. When affected posts are viewed by a higher privileged user, this could lead to script execution in the editor/wp-admin. This has been patched in version 5.4.2, along with all the previously affected versions via a minor | Medium 5.4 | 12 Jun 2020 |
| CVE-2020-11026 | In affected versions of WordPress, files with a specially crafted name when uploaded to the Media section can lead to script execution upon accessing the file. This requires an authenticated user with privileges to upload files. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4. | High 8.7 | 30 Apr 2020 |
| CVE-2020-11027 | In affected versions of WordPress, a password reset link emailed to a user does not expire upon changing the user password. Access would be needed to the email account of the user by a malicious party for successful execution. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5. | Medium 6.1 | 30 Apr 2020 |
| CVE-2020-11028 | In affected versions of WordPress, some private posts, which were previously public, can result in unauthenticated disclosure under a specific set of conditions. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.3 | Medium 5.8 | 30 Apr 2020 |
| CVE-2020-11029 | In affected versions of WordPress, a vulnerability in the stats() method of class-wp-object-cache.php can be exploited to execute cross-site scripting (XSS) attacks. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3 | Medium 5.8 | 30 Apr 2020 |
| CVE-2020-11030 | In affected versions of WordPress, a special payload can be crafted that can lead to scripts getting executed within the search block of the block editor. This requires an authenticated user with the ability to add content. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, | Medium 6.4 | 30 Apr 2020 |
| CVE-2020-11025 | In affected versions of WordPress, a cross-site scripting (XSS) vulnerability in the navigation section of Customizer allows JavaScript code to be executed. Exploitation requires an authenticated user. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.2 | Medium 5.8 | 30 Apr 2020 |
| CVE-2019-20042 | In wp-includes/formatting.php in WordPress 3.7 to 5.3.0, the function wp_targeted_link_rel() can be used in a particular way to result in a stored cross-site scripting (XSS) vulnerability. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 via a minor release. | Medium 6.1 | 27 Dec 2019 |
| CVE-2019-20043 | In in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in WordPress 3.7 to 5.3.0, authenticated users who do not have the rights to publish a post are able to mark posts as sticky or unsticky via the REST API. For example, the contributor role does not have such rights, but this allowed them to bypass that. This has been patched in WordPress 5.3.1, along with all the previous Word | Medium 4.3 | 27 Dec 2019 |
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content
What this pays
sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs.
Finding │ Program pays │ Through sorona.xyz
Low severity │ $150 │ $1,063 avg for high)
Critical severity │ $1,500+ │ $1,875+
Reported before public fix/release │ bounty doubled │ bounty doubled Submit a vulnerability
CVE history
23
Last 12 months
356
Lifetime
XSS 38 %
Access control 18 %
Injection 14 %
Info disclosure 10 %
Latest advisories
Loading the feed
Overview
Route your report through sorona.xyz to receive 1.25x the rewards offered, plus up to $1,000 more for especially complex or well-chained bugs. WordPress powers roughly 40% of the web, and its core, editor, and companion projects are actively maintained under a coordinated disclosure process.
In scope
WordPress Core, its REST API, and the WordPress.org website itself
The Gutenberg block editor and the Classic Editor plugin
WP-CLI (both the software and its website) and the GlotPress translation platform software (the glotpress.blog site is out of scope)
The companion projects BuddyPress (buddypress.org and subdomains) and bbPress (bbpress.org), reported alongside Core
WordCamp.org and *.wordcamp.org, plus canonical plugins distributed through WordPress.org
WordPress.org infrastructure hosts: api.wordpress.org, profiles.wordpress.org, planet.wordpress.org, codex.wordpress.org, lists.wordpress.org, the *.wordpress.net range, and the wider *.wordpress.org wildcard
Developer and version-control infrastructure: *.trac.wordpress.org, *.svn.wordpress.org, *.git.wordpress.org, and the repositories under github.com/WordPress
Related foundation and community domains: wordpressfoundation.org, doaction.org, and gutenberg.run
Out of scope
WordPress.com and every *.wordpress.com domain, those are Automattic commercial properties handled separately, not this program
The WordPress mobile apps (Android org.wordpress.android, iOS app id 335703880) and the github.com/wordpress-mobile repositories
Third-party plugins and themes not maintained by WordPress.org (report those to the Plugin Review team), and non-canonical plugins generally
Self-XSS in wp-admin that only an already-privileged user can trigger against themselves
Brute-force, denial-of-service, and phishing testing, plus text injection into user-generated wiki, forum, or support content
Low-impact information leaks, user ID or username enumeration, path disclosure, and software version disclosure
Missing HTTP security headers with no demonstrated impact, XML-RPC availability reports without proven impact, and unverified automated-scanner output without a working PoC
Most-valued findings
Stored and reflected cross-site scripting (XSS) in Core, the editor, and admin surfaces
SQL injection and remote code execution (RCE) in Core or companion software
Server-side request forgery (SSRF) and cross-site request forgery (CSRF) that carries meaningful impact
Privilege escalation, a lower-privileged role gaining admin capabilities, and authentication or authorization bypass
Any reproducible flaw with a severe effect on user security or privacy, meeting the CVSS v3 base-score floor of 4.0 (or reaching it through a chain)
Program rules
Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards.
Only the first reporter of a given vulnerability is eligible for a reward
Test against the latest release and include clear, minimal reproduction steps
Do not access, modify, or exfiltrate data belonging to other users
Submit one distinct issue per report and avoid duplicate filings
Keep testing to accounts and instances you control; never target real users
Report quality and severity determine the payout amount
Disclosure
Coordinated disclosure applies: give the maintainers reasonable time to investigate and ship a fix before any public write-up. Publishing details before resolution can disqualify the report.
Safe harbor
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability$188
Medium/High severity │ several hundred USD ($850 avg for high) │ several hundred USD (