Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 26

Export CSV
CVE-2026-125778

WordPress myCred plugin <= 4.0.2 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in myCred myCred mycred allows Code Injection.This issue affects myCred: from n/a through 4.0.2.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mycred Wordpress-extensions
Products
Mycred Mycred
CVE-2026-103077

WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mycred Wordpress-extensions
Products
Mycred Mycred
CVE-2026-97072

WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mycred Wordpress-extensions
Products
Mycred Mycred
CVE-2026-123471

WordPress myCred plugin <= 4.0.2 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in myCred myCred mycred allows Code Injection.This issue affects myCred: from n/a through 4.0.2.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mycred Wordpress-extensions
Products
Mycred Mycred
CVE-2026-124274

WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mycred Wordpress-extensions
Products
Mycred Mycred
CVE-2026-122668

WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mycred Wordpress-extensions
Products
Mycred Mycred
CVE-2026-123462

WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mycred Wordpress-extensions
Products
Mycred Mycred
CVE-2026-123465

WordPress myCred plugin <= 4.0.2 - Sensitive Data Exposure vulnerability

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in myCred myCred mycred allows Retrieve Embedded Sensitive Data.This issue affects myCred: from n/a through 4.0.2.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Mycred Wordpress-extensions
Products
Mycred Mycred
CVE-2026-15150

myCred < 3.2.5 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver Verification in buyCRED

The myCred WordPress plugin before 3.2.5 does not verify that the receiver of an incoming payment gateway notification matches the site's configured merchant account, allowing unauthenticated attackers to have arbitrary amounts of the site's in-site currency credited to an account by completing a payment for the expected amount to a gateway account they control rather than the site's.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mycred Wordpress
Products
Mycred Wordpress
CVE-2026-28163

WordPress New User Approve plugin <= 3.2.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in myCred New User Approve allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects New User Approve: from n/a through 3.2.8.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mycred Wordpress
Products
New User Approve Wordpress
CVE-2026-56013

WordPress License Manager for WooCommerce plugin <= 3.0.15 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References (IDOR) in License Manager for WooCommerce <= 3.0.15 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mycred Wordpress
Products
License Manager For Woocommerce Wordpress
CVE-2025-69332

WordPress Bookify plugin <= 1.1.1 - Broken Access Control vulnerability

Subscriber Broken Access Control in Bookify <= 1.1.1 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mycred Wordpress
Products
Bookify Wordpress
CVE-2026-40794

WordPress myCred plugin <= 3.0.3 - Broken Access Control vulnerability

Subscriber Broken Access Control in myCred <= 3.0.3 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mycred Wordpress
Products
Mycred Wordpress
CVE-2026-42676

WordPress myCred plugin <= 3.0.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in myCred allows Stored XSS. This issue affects myCred: from n/a through 3.0.4.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mycred Wordpress
Products
Mycred Wordpress
CVE-2024-43354

WordPress myCred plugin <= 2.7.2 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Saad Iqbal myCred mycred.This issue affects myCred: from n/a through <= 2.7.2.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Mycred
Products
Mycred
CVE-2025-54668

WordPress myCred plugin <= 2.9.4.3 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saad Iqbal myCred mycred allows Stored XSS.This issue affects myCred: from n/a through <= 2.9.4.3.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mycred Wordpress
Products
Mycred Wordpress
CVE-2025-54667

WordPress myCred plugin <= 2.9.4.3 - Race Condition Vulnerability

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Saad Iqbal myCred mycred allows Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions.This issue affects myCred: from n/a through <= 2.9.4.3.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mycred Wordpress
Products
Mycred Wordpress
CVE-2024-49702

WordPress myCred Elementor plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saad Iqbal myCred Elementor mycred-for-elementor allows Stored XSS.This issue affects myCred Elementor: from n/a through <= 1.2.6.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mycred
Products
Mycred Elementor
CVE-2024-43353

WordPress myCred plugin <= 2.7.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saad Iqbal myCred mycred.This issue affects myCred: from n/a through <= 2.7.2.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mycred Wordpress
Products
Mycred Wordpress
CVE-2024-43214

WordPress myCred plugin <= 2.7.2 - Sensitive Data Exposure vulnerability

Missing Authorization vulnerability in Saad Iqbal myCred mycred.This issue affects myCred: from n/a through <= 2.7.2.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mycred Wpexperts
Products
Mycred Mycred