Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 23

Export CSV
CVE-2024-8658

myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits for Gamification <= 2.7.3 - Missing Authorization to Unauthenticated Database Upgrade

The myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits for Gamification plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the mycred_update_database() function in all versions up to, and including, 2.7.3. This makes it possible for unauthenticated attackers to upgrade an out of date database.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mycred
Products
Mycred
CVE-2021-25015

myCred < 2.4 - Reflected Cross-Site Scripting

The myCred WordPress plugin before 2.4 does not sanitise and escape the search query before outputting it back in the history dashboard page, leading to a Reflected Cross-Site Scripting issue

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Mycred
Products
Mycred
CVE-2017-20008

myCRED < 1.7.8 - Reflected Cross-Site Scripting

The myCred WordPress plugin before 1.7.8 does not sanitise and escape the user parameter before outputting it back in the Points Log admin dashboard, leading to a Reflected Cross-Site Scripting

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Mycred
Products
Mycred