Executive brief
myCred is a popular WordPress plugin used to manage loyalty programs and points systems. A security flaw allows an attacker with basic user permissions to inject malicious scripts into the website. If an administrator or another visitor views the affected page, the script could redirect them to malicious sites, steal session information, or display unauthorized advertisements.
Technical details
A Stored Cross-Site Scripting (XSS) vulnerability exists in the myCred plugin for WordPress (versions up to 3.0.4) due to improper neutralization of user-supplied input during web page generation (CWE-79). An attacker with 'Subscriber' or higher privileges can inject malicious JavaScript payloads that are permanently stored on the server. The vulnerability is triggered when a privileged user, such as an administrator, interacts with the affected page or component. Successful exploitation can lead to session hijacking, unauthorized redirects, or modification of page content. The issue is resolved in version 3.0.5.
Affected products
- myCred myCred up to 3.0.4
Timeline
- 2026-04-15: other: Reported by thevietronin
- 2026-05-15: advisory: Patchstack advisory published
- 2026-06-01: disclosed: CVE published to NVD