CVE-2026-17149 in myCred Plugin
Summary
by MITRE • 09/09/2026
The Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute in all versions up to, and including, 3.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The myCred plugin is a widely utilized WordPress extension designed to implement gamification mechanics within websites by managing points, ranks, badges, and loyalty rewards for users. While the core functionality of this plugin enhances user engagement through structured reward systems, it has been identified as containing significant security vulnerabilities in versions up to 3.2.4. The primary concern arises from insufficient input sanitization and output escaping mechanisms embedded within the shortcode attributes used by the system. Specifically, the wrapper attribute associated with shortcodes fails to adequately validate or sanitize user-supplied data before processing, creating a pathway for malicious code injection. This architectural flaw allows authenticated attackers who possess contributor-level access or higher privileges to exploit this weakness effectively.
The technical nature of this vulnerability is classified as Stored Cross-Site Scripting, also known as persistent XSS. Unlike reflected XSS attacks where the malicious script is executed immediately within a session, stored vulnerabilities involve injecting code that is saved on the target server, typically in a database or content field. In this specific case, an attacker with sufficient permissions can inject arbitrary web scripts into pages via the vulnerable wrapper shortcode attribute. Once injected, these scripts are not merely displayed but are rendered and executed by any user who subsequently accesses the compromised page. This persistence ensures that the malicious payload remains active until manually removed from the system, significantly increasing the potential blast radius of the attack compared to transient vulnerabilities.
The operational impact of this vulnerability is severe due to its reliance on authenticated access with relatively low privilege levels. Contributor-level users are often granted permissions to create and edit content without needing full administrative control, making them a common target for exploitation by individuals seeking to escalate their influence or cause disruption within the platform. When an attacker successfully injects malicious scripts, they can perform actions such as stealing session cookies, hijacking user sessions, defacing web pages, redirecting users to phishing sites, or executing arbitrary commands on behalf of the victim. Because the script executes in the context of the logged-in administrator or other high-privilege users who view the content, it effectively bypasses many standard security boundaries that rely solely on authentication checks rather than strict data validation and output encoding.
From a classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific mechanism involves the failure to sanitize input (CWE-601) and the lack of proper output escaping when rendering dynamic content via shortcodes. In terms of offensive security frameworks, this behavior corresponds to techniques found in the MITRE ATT&CK for Enterprise matrix, particularly under Tactic TA0005 Defense Evasion or TA0002 Execution, where attackers use client-side scripting to bypass defenses and execute unauthorized actions. The persistence aspect also relates to persistence mechanisms that allow long-term access or impact without requiring repeated exploitation attempts.
To mitigate this vulnerability, immediate action is required for all organizations running myCred versions 3.2.4 and below. The most effective remediation strategy is to upgrade the plugin to a patched version where the developers have implemented robust input validation and output encoding practices specifically targeting the wrapper shortcode attribute. Administrators should ensure that their WordPress environment includes automatic update mechanisms or regular manual checks for security patches. Additionally, implementing strict Content Security Policy headers can help mitigate the impact of any residual XSS vulnerabilities by restricting the sources from which scripts are allowed to execute. Regular audits of user permissions and monitoring for unusual content modifications can also aid in early detection of such injection attempts before they cause significant harm.