Patchstack Alliance September Winners & Leaderboard

Published 21 October 2022
Updated 24 July 2023
Mart Virkus
Head of Marketing
Table of Contents

With another busy month behind us, let’s see what the Patchstack Alliance members dug up in September!

Our researchers found 53 confirmed vulnerabilities. 9 of the vulnerabilities were found in plugins with 100,000+ installs across WordPress, including one with 2 million installs. Thought to be fair, that vulnerability in question was not particularly severe.

A couple of vulnerabilities picked up did, however, have a CVSS score over 9.0.

Leaderboard and winners

September bug hunt winners are below:

Congrats to Lana Codes for turning up the heat, and nabbing the top spot this month!

A shoutout to L.Ayotte & T.Jacobs, who are not part of the Alliance but who did report a vulnerability in their own product – we salute you.

How are points awarded?

The score we use to see who gets what prize is made up of several factors, including the popularity of the plugin and the severity of the vulnerability.

For example, a vulnerability with a CVSS score of 6 in a plugin with 1,000,000 installs will give more points than a very critical vulnerability in a plugin with only 1,000 installs.

All reports are important, though, and help make the web more secure! On this note, we want to say thanks to all researchers who submitted vulnerability reports last month!

If you want to compete in the bug hunt and contribute to making WordPress safer, you can join the Patchstack Alliance here.

What is Patchstack Alliance?

Patchstack Alliance is a community of ethical hackers and researchers who support the open web by finding and reporting vulnerabilities in WordPress plugins and themes.

All valid vulnerabilities are also publicly available in our vulnerability database.

The latest in Patchstack News

Looks like your browser is blocking our support chat widget. Turn off adblockers and reload the page.