Read the docs

myCred

Records20All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

myCred records in CISA KEV

No myCred vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Mycred 4 records LOW Mycred Elementor 1 record LOW

Records

20 records

TI-2026-82461 CVE-2026-97073 · GHSA-3wxm-5j5c-8jvm

Missing authorization in WordPress myCred plugin

Priority LOW 30

Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00261 Published 2026-10-29 No fix listed CWE-862
TI-2024-08032 CVE-2024-8658 · GHSA-qq5m-8wpj-8q6h

Missing authorization in saadiqbal Points Management System For Gamification, Ranks…

Priority LOW 30

The myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits for Gamification plugin for WordPress is vulnerable to una…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00327 Published 2024-09-25 No fix listed CWE-862
TI-2026-86462 CVE-2026-124274 · GHSA-4fhm-wfm9-x94p

Missing authorization in WordPress myCred plugin

Priority LOW 29

Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00176 Published 2026-11-07 No fix listed CWE-862
TI-2024-33188 CVE-2024-49702 · GHSA-77mh-xjf8-j56x

WordPress myCred Elementor plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability

Priority LOW 29

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saad Iqbal myCred Elementor mycred-for-elementor allows Stored XSS.This issue affects myCred Elementor: from n/a throu…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00276 Published 2024-10-24 No fix listed CWE-79
TI-2023-25961 CVE-2023-47853 · GHSA-r6j3-6w6j-pv96

WordPress myCred Plugin <= 2.6.1 is vulnerable to Cross Site Scripting (XSS)

Priority LOW 29

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in myCred myCred – Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin allows Stored XSS.This issue affects myC…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00385 Published 2023-11-30 No fix listed CWE-79
TI-2021-07293 CVE-2021-25015 · GHSA-5w6q-xrqg-g6cg

myCred < 2.4 - Reflected Cross-Site Scripting

Priority LOW 29

The myCred WordPress plugin before 2.4 does not sanitise and escape the search query before outputting it back in the history dashboard page, leading to a Reflected Cross-Site Scripting issue

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00887 Published 2022-01-24 Fixed in 2.4 CWE-79
TI-2017-14081 CVE-2017-20008 · GHSA-wh5j-hw7g-r9fm

myCRED < 1.7.8 - Reflected Cross-Site Scripting

Priority LOW 29

The myCred WordPress plugin before 1.7.8 does not sanitise and escape the user parameter before outputting it back in the Points Log admin dashboard, leading to a Reflected Cross-Site Scripting

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00912 Published 2021-11-29 Fixed in 1.7.8 CWE-79
TI-2024-09447 CVE-2024-10187 · GHSA-943v-4mfm-9hjg

myCred <= 2.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via mycred_link Shortcode

Priority LOW 28

The myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits for Gamification plugin for WordPress is vulnerable to Sto…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00342 Published 2024-11-08 No fix listed CWE-79
TI-2026-79224 CVE-2026-114698 · GHSA-4gg9-rw7r-3w7x

Authorization bypass in WordPress myCred plugin

Priority LOW 24

Authorization Bypass Through User-Controlled Key vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.0-beta.1.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00241 Published 2026-10-22 No fix listed CWE-639
TI-2026-86481 CVE-2026-122668 · GHSA-6mh9-pqg5-m889

Missing authorization in myCred WordPress plugin

Priority LOW 20

Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00243 Published 2026-11-07 No fix listed CWE-862
TI-2026-86159 CVE-2026-123471 · GHSA-rmc9-2wm2-x4rv

Cross-site scripting in myCred WordPress plugin

Priority LOW 20

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in myCred myCred mycred allows Code Injection.This issue affects myCred: from n/a through 4.0.2.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00237 Published 2026-11-06 No fix listed CWE-80
TI-2026-84439 CVE-2026-103077 · GHSA-93v9-gm32-3896

Missing authorization check in myCred WordPress plugin

Priority LOW 20

Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00235 Published 2026-11-03 No fix listed CWE-862
TI-2026-82351 CVE-2026-115962 · GHSA-3f2c-qxpp-ff5f

Authentication bypass by spoofing in myCred WordPress plugin

Priority LOW 20

Authentication Bypass by Spoofing vulnerability in myCred myCred mycred allows Identity Spoofing.This issue affects myCred: from n/a through 4.0.1.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00259 Published 2026-10-29 No fix listed CWE-290
TI-2026-84438 CVE-2026-97072 · GHSA-cxmj-cwjh-78g8

Missing authorization in WordPress myCred plugin

Priority LOW 19

Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00198 Published 2026-11-03 No fix listed CWE-862
Open these records in search →