Mycred vulnerabilities
12 vulnerabilities
Known vulnerabilities in Mycred products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 6 products.
Products
6- Mycred7 vulnerabilities
- Bookify1 vulnerabilities
- License Manager For Woocommerce1 vulnerabilities
- Mycred – Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin1 vulnerabilities
- Mycred Elementor1 vulnerabilities
- New User Approve1 vulnerabilities
CVE-2021-25015mycredmycred+2
EPSS score0.89%
The myCred WordPress plugin before 2.4 does not sanitise and escape the search query before outputting it back in the history dashboard page, leading to a Reflected Cross-Site Scripting issueCVE-2025-69332mycredbookify+1EPSS score0.33%
Subscriber Broken Access Control in Bookify <= 1.1.1 versions.CVE-2017-20008mycredmycred+2EPSS score0.91%
The myCred WordPress plugin before 1.7.8 does not sanitise and escape the user parameter before outputting it back in the Points Log admin dashboard, leading to a Reflected Cross-Site ScriptingCVE-2024-10187mycredmycred+2EPSS score0.34%
The myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits for Gamification plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's mycred_link shortcode in all versions up to, and including, 2.7.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2024-49702mycredmycred_elementor+2EPSS score0.28%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saad Iqbal myCred Elementor mycred-for-elementor allows Stored XSS.This issue affects myCred Elementor: from n/a through <= 1.2.6.CVE-2024-8658mycredmycred+2EPSS score0.33%
The myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits for Gamification plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the mycred_update_database() function in all versions up to, and including, 2.7.3. This makes it possible for unauthenticated attackers to upgrade an out of date database.CVE-2026-40794mycredmycred+1EPSS score0.30%
Subscriber Broken Access Control in myCred <= 3.0.3 versions.CVE-2026-42676mycredmycred+1EPSS score0.22%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in myCred allows Stored XSS.
This issue affects myCred: from n/a through 3.0.4.CVE-2026-56013mycredlicense manager for woocommerce+1EPSS score0.33%
Unauthenticated Insecure Direct Object References (IDOR) in License Manager for WooCommerce <= 3.0.15 versions.CVE-2026-28163mycrednew user approve+1EPSS score0.29%
Missing Authorization vulnerability in myCred New User Approve allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects New User Approve: from n/a through 3.2.8.CVE-2023-47853mycredmycred – points, rewards, gamification, ranks, badges & loyalty plugin+2EPSS score0.39%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in myCred myCred – Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin allows Stored XSS.This issue affects myCred – Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin: from n/a through 2.6.1.CVE-2023-35096mycredmycred+2EPSS score0.25%
Cross-Site Request Forgery (CSRF) vulnerability in myCred plugin <= 2.5 versions.