CVE-2026-125809: WordPress myCred plugin <= 4.0.2 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in myCred myCred mycred allows Stored XSS.This issue affects myCred: from n/a through 4.0.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.0.3
Event History
Frequently Asked Questions
Who can exploit this issue?
The CVSS vector indicates that an attacker needs low-level privileges and user interaction. The vulnerability is remotely reachable over the network and has low attack complexity.
What versions are affected?
myCred versions through 4.0.2 are affected. The provided data does not identify a fixed version.
What is the potential impact?
A successful stored XSS attack can affect confidentiality, integrity, and availability at low impact levels. The scope is changed, meaning the vulnerable component can affect another security authority.