Executive brief
The myCred plugin for WordPress, which manages loyalty points and rewards, is vulnerable to a security flaw that allows certain users to inject malicious scripts into website pages. An attacker with contributor-level access or higher can use this to target other users, including site administrators, potentially leading to unauthorized actions or data theft when those users view the affected pages. This could compromise the integrity of the rewards program and the security of site visitors.
Technical details
The myCred plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on the 'wrap' attribute within its shortcodes. Authenticated attackers with contributor-level permissions or higher can exploit this by injecting arbitrary web scripts into pages. These scripts execute in the context of any user's browser who visits the compromised page. The vulnerability is present in all versions up to and including 3.1. A patch appears to be available in subsequent versions (e.g., 3.1.1 or via changeset 3572451).
Affected products
- saadiqbal myCred up to, and including, 3.1
Timeline
- 2026-06-17: disclosed
- 2026-06-17: advisory
References
- https://plugins.trac.wordpress.org/browser/mycred/tags/3.0.2/includes/classes/class.query-leaderboard.php
- https://plugins.trac.wordpress.org/browser/mycred/tags/3.0.2/includes/shortcodes/mycred_leaderboard.php
- https://plugins.trac.wordpress.org/browser/mycred/tags/3.0.6/includes/classes/class.query-leaderboard.php
- https://plugins.trac.wordpress.org/browser/mycred/tags/3.0.6/includes/shortcodes/mycred_leaderboard.php
- https://plugins.trac.wordpress.org/browser/mycred/tags/3.1.1/includes/classes/class.query-leaderboard.php
- https://plugins.trac.wordpress.org/browser/mycred/tags/3.1.1/includes/mycred-functions.php
- https://plugins.trac.wordpress.org/changeset/3572451