Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

4 records

Vendor: myCred Component: Mycred Clear all filters
TI-2024-09447 CVE-2024-10187 · GHSA-943v-4mfm-9hjg

myCred <= 2.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via mycred_link Shortcode

Priority LOW 28

The myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits for Gamification plugin for WordPress is vulnerable to Sto…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00342 Published 2024-11-08 No fix listed CWE-79
TI-2024-08032 CVE-2024-8658 · GHSA-qq5m-8wpj-8q6h

Missing authorization in saadiqbal Points Management System For Gamification, Ranks…

Priority LOW 30

The myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits for Gamification plugin for WordPress is vulnerable to una…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00327 Published 2024-09-25 No fix listed CWE-862
TI-2021-07293 CVE-2021-25015 · GHSA-5w6q-xrqg-g6cg

myCred < 2.4 - Reflected Cross-Site Scripting

Priority LOW 29

The myCred WordPress plugin before 2.4 does not sanitise and escape the search query before outputting it back in the history dashboard page, leading to a Reflected Cross-Site Scripting issue

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00887 Published 2022-01-24 Fixed in 2.4 CWE-79
TI-2017-14081 CVE-2017-20008 · GHSA-wh5j-hw7g-r9fm

myCRED < 1.7.8 - Reflected Cross-Site Scripting

Priority LOW 29

The myCred WordPress plugin before 1.7.8 does not sanitise and escape the user parameter before outputting it back in the Points Log admin dashboard, leading to a Reflected Cross-Site Scripting

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00912 Published 2021-11-29 Fixed in 1.7.8 CWE-79