myCred EUVD-2026-33687

The attacker must hold a low-privileged authenticated WordPress account on the target site, as confirmed by PR:L in the CVSS vector - this could be a default subscriber role obtainable through open user registration. Victim interaction is required: a higher-privileged user (such as an administrator or editor) must navigate to the page where the injected payload is rendered, as confirmed by UI:R in the CVSS vector. The myCred plugin must be installed, activated, and configured to allow lower-privileged users to interact with input fields that are later displayed to other users. Key limiting factors: fully unauthenticated exploitation is not possible; the attacker cannot control when or whether a privileged victim visits the poisoned page; and the impact is bounded to confidentiality, integrity, and availability at Low levels per the CVSS vector, reflecting browser-scope impact rather than server-side code execution.

The CVSS 6.5 Medium score is driven by the vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. Attack vector is Network with low complexity, but exploitation requires a low-privileged authenticated account (PR:L) and victim interaction (UI:R), which meaningfully reduce opportunistic risk compared to unauthenticated stored XSS. The Changed scope elevates the score by recognizing cross-boundary browser impact. EPSS data was not provided in the available intelligence, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is not listed in CISA KEV, and no public exploit code has been identified, indicating this is not actively exploited at scale. Real-world risk is moderate: an attacker must obtain at minimum a registered WordPress account to inject the payload, ruling out fully anonymous exploitation, though the stored nature means a single successful injection can affect multiple higher-privileged victims over time.

An attacker with a low-privileged WordPress account - such as a subscriber created through normal site registration - submits a crafted JavaScript payload into a myCred input field, for example a point log comment or profile badge field, which is stored in the WordPress database. When a site administrator later navigates to the page rendering that stored content, the script executes silently in the administrator's browser, exfiltrating their session cookie or issuing authenticated WordPress admin requests on the attacker's behalf. No public exploit identified at time of analysis, but the attack pattern for stored XSS is well-documented and low-sophistication once the injection point is identified.