CVE-2026-125778: WordPress myCred plugin <= 4.0.2 - Content Injection vulnerability

Q: What access does an attacker need to exploit this issue?

The vulnerability has a low-privileges-required rating (PR:L), so an attacker needs an authenticated account with at least low-level permissions. No user interaction is required.

Q: Can this be exploited remotely, and what is the expected impact?

The attack vector is network-based (AV:N) and has low attack complexity (AC:L). The stated impact is limited to low confidentiality impact; integrity and availability impacts are rated as none.

Q: Which myCred versions are affected?

The issue affects myCred versions through 4.0.2. The available data does not identify a fixed version.

Published Nov 11, 2026

Updated

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in myCred myCred mycred allows Code Injection.This issue affects myCred: from n/a through 4.0.2.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress myCred plugin to a version that resolves this vulnerability.
Fixed in 4.0.3

Event History

Nov 11, 2026

CVE Published

via MITRE·12:38 PM

Data Sourced

via MITRE·12:38 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The vulnerability has a low-privileges-required rating (PR:L), so an attacker needs an authenticated account with at least low-level permissions. No user interaction is required.

Can this be exploited remotely, and what is the expected impact?

The attack vector is network-based (AV:N) and has low attack complexity (AC:L). The stated impact is limited to low confidentiality impact; integrity and availability impacts are rated as none.

Which myCred versions are affected?

The issue affects myCred versions through 4.0.2. The available data does not identify a fixed version.

CVE-2026-125778: WordPress myCred plugin <= 4.0.2 - Content Injection vulnerability

Remediation

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Can this be exploited remotely, and what is the expected impact?

Which myCred versions are affected?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Can this be exploited remotely, and what is the expected impact?

Which myCred versions are affected?