What is the CVSS score of CVE-2026-8607?

CVE-2026-8607 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

myCred CVE-2026-8607

EUVD-2026-37562 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-17 Wordfence

WordPress XSS Wordpress Plugin Points Management System For Gamification Ranks Badges And Loyalty Rewards Program Mycred Saadiqbal

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

PR:L confirmed by contributor requirement; UI:R reflects that a victim must visit the injected page for payload execution; S:C and C:L/I:L capture cross-browser session impact with no availability consequence.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 08:21 vuln.today

CVE Published

Jun 17, 2026 - 06:49 cve.org

MEDIUM 6.4

DescriptionCVE.org

The Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program - myCred plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wrap' Shortcode Attribute in all versions up to, and including, 3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored XSS in the myCred WordPress plugin (versions up to and including 3.1) allows authenticated attackers holding contributor-level access or above to inject persistent JavaScript payloads via the unsanitized 'wrap' shortcode attribute in the leaderboard shortcode handler. When any user - including administrators - visits a page containing the injected shortcode, the payload executes in their browser, enabling session hijacking or privilege escalation. No public exploit or CISA KEV listing has been identified at time of analysis; fix is available in version 3.1.1 as confirmed by WordPress plugin trac changeset 3572451.

Technical ContextAI

The flaw is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS), occurring specifically in the myCred leaderboard shortcode rendering pipeline. Vulnerable code paths are traceable in the WordPress plugin trac to includes/classes/class.query-leaderboard.php (line 1042 in the 3.0.2 and 3.0.6 tags) and includes/shortcodes/mycred_leaderboard.php (line 20), where the 'wrap' attribute value is interpolated directly into HTML output without calling WordPress sanitization functions such as esc_attr() or wp_kses(). The 3.1.1 tag shows the same class at a shifted line (L976) alongside changes in includes/mycred-functions.php (L4399), indicating refactored sanitization logic was introduced. WordPress shortcodes accept arbitrary key-value attributes by design, making every unescaped attribute a potential stored XSS vector. CPE: cpe:2.3:a:saadiqbal:points_management_system_for_gamification,_ranks,_badges,_and_loyalty_rewards_program_-_mycred:*:*:*:*:*:*:*:*.

RemediationAI

Update the myCred WordPress plugin to version 3.1.1 or later; this is the vendor-released patch as evidenced by WordPress plugin trac changeset 3572451 and modified code visible in the 3.1.1 repository tag at includes/classes/class.query-leaderboard.php and includes/mycred-functions.php. Full advisory details are at https://www.wordfence.com/threat-intel/vulnerabilities/id/041a7c9a-d7dc-4742-b879-f1836f324a46. If immediate patching is not feasible, restrict the contributor role to fully trusted internal users only, removing it from any publicly registerable roles - this eliminates the attacker's required access level but may impact editorial workflows. Alternatively, disable the myCred leaderboard shortcode via a mu-plugin filter (add_filter('mycred_shortcodes', ...)) until the upgrade can be applied; note this disables leaderboard display site-wide. A Web Application Firewall rule blocking <script, javascript:, and onerror= patterns in shortcode attribute submissions provides a partial defense-in-depth layer but should not substitute for patching.