CVE-2026-42676
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
The myCred plugin is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 3.0.4. Improper neutralization of input during web page generation allows attackers to inject malicious scripts that are then executed in other users' browsers.
Risk Assessment
An attacker can steal user sessions, redirect users to malicious sites, or perform other unauthorized actions in the context of their accounts.
Recommendation
Immediately update the myCred plugin to the latest available version that includes a fix for this vulnerability.
Other vulnerabilities in myCred
See all- CVE-2026-15150Medium
The myCred WordPress plugin before 3.2.5 does not verify that the receiver of an incoming payment gateway notification matches the site's configured merchant account, allowing unauthenticated attackers to have arbitrary amounts of the site's in-site currency credited to an account by completing a payment for the expected amount to a gateway account they control rather than the site's.
- CVE-2026-61968Medium
The myCred WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 3.1.2.
- CVE-2026-40794Medium
Versions of myCred up to 3.0.3 have a vulnerability in access control, allowing unauthorized access to subscriber resources.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in myCred allows Stored XSS. This issue affects myCred: from n/a through 3.0.4.