Points Management System For Gamification Ranks Badges And Loyalty Rewards Program Mycred
Monthly
Stored Cross-Site Scripting in the myCred gamification plugin for WordPress allows authenticated contributors to inject persistent malicious scripts via the 'wrapper' shortcode attribute in the sell-content addon. All plugin versions through 3.2.4 are affected. Any site visitor who loads a page containing the poisoned shortcode will execute the attacker's payload in their browser, enabling session hijacking, credential theft, or admin account compromise. No public exploit or KEV listing is present at time of analysis, but the contributor-level prerequisite is a low bar on sites with open registration.
Stored XSS in the myCred WordPress plugin (versions up to and including 3.1) allows authenticated attackers holding contributor-level access or above to inject persistent JavaScript payloads via the unsanitized 'wrap' shortcode attribute in the leaderboard shortcode handler. When any user - including administrators - visits a page containing the injected shortcode, the payload executes in their browser, enabling session hijacking or privilege escalation. No public exploit or CISA KEV listing has been identified at time of analysis; fix is available in version 3.1.1 as confirmed by WordPress plugin trac changeset 3572451.
Stored Cross-Site Scripting in the myCred gamification plugin for WordPress allows authenticated contributors to inject persistent malicious scripts via the 'wrapper' shortcode attribute in the sell-content addon. All plugin versions through 3.2.4 are affected. Any site visitor who loads a page containing the poisoned shortcode will execute the attacker's payload in their browser, enabling session hijacking, credential theft, or admin account compromise. No public exploit or KEV listing is present at time of analysis, but the contributor-level prerequisite is a low bar on sites with open registration.
Stored XSS in the myCred WordPress plugin (versions up to and including 3.1) allows authenticated attackers holding contributor-level access or above to inject persistent JavaScript payloads via the unsanitized 'wrap' shortcode attribute in the leaderboard shortcode handler. When any user - including administrators - visits a page containing the injected shortcode, the payload executes in their browser, enabling session hijacking or privilege escalation. No public exploit or CISA KEV listing has been identified at time of analysis; fix is available in version 3.1.1 as confirmed by WordPress plugin trac changeset 3572451.