Read the docs

myCred

Records21All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

myCred records in CISA KEV

No myCred vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Mycred 4 records LOW Mycred Elementor 1 record LOW

Records

4 records in Mycred · all components

TI-2024-08032 CVE-2024-8658 · GHSA-qq5m-8wpj-8q6h

Missing authorization in saadiqbal Points Management System For Gamification, Ranks…

Priority LOW 30

The myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits for Gamification plugin for WordPress is vulnerable to una…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00327 Published 2024-09-25 No fix listed CWE-862
TI-2021-07293 CVE-2021-25015 · GHSA-5w6q-xrqg-g6cg

myCred < 2.4 - Reflected Cross-Site Scripting

Priority LOW 29

The myCred WordPress plugin before 2.4 does not sanitise and escape the search query before outputting it back in the history dashboard page, leading to a Reflected Cross-Site Scripting issue

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00887 Published 2022-01-24 Fixed in 2.4 CWE-79
TI-2017-14081 CVE-2017-20008 · GHSA-wh5j-hw7g-r9fm

myCRED < 1.7.8 - Reflected Cross-Site Scripting

Priority LOW 29

The myCred WordPress plugin before 1.7.8 does not sanitise and escape the user parameter before outputting it back in the Points Log admin dashboard, leading to a Reflected Cross-Site Scripting

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00912 Published 2021-11-29 Fixed in 1.7.8 CWE-79
TI-2024-09447 CVE-2024-10187 · GHSA-943v-4mfm-9hjg

myCred <= 2.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via mycred_link Shortcode

Priority LOW 28

The myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits for Gamification plugin for WordPress is vulnerable to Sto…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00342 Published 2024-11-08 No fix listed CWE-79
Open these records in search →