Skip to content
Noroxi

myCred

mycred · plugin

Known security vulnerabilities for myCred. Find out in seconds which version runs on your site with WP Lens.

25 known vulnerabilities

1 critical · 1 with public exploit code · latest Sep 9, 2026

Vulnerabilities

  • CVE-2024-43354

    WordPress myCred plugin <= 2.7.2 - PHP Object Injection vulnerability

    Critical 9.8

  • CVE-2023-35096

    WordPress myCred Plugin <= 2.5 is vulnerable to Cross Site Request Forgery (CSRF)

    High 8.8

  • CVE-2026-40794

    WordPress myCred plugin <= 3.0.3 - Broken Access Control vulnerability

    Medium 6.5

  • CVE-2026-42676

    WordPress myCred plugin <= 3.0.4 - Cross Site Scripting (XSS) vulnerability

    Medium 6.5

  • CVE-2026-27440

    WordPress myCred plugin <= 2.9.7.6 - Cross Site Scripting (XSS) vulnerability

    Medium 6.5

  • CVE-2025-54668

    WordPress myCred plugin <= 2.9.4.3 - Cross Site Scripting (XSS) Vulnerability

    Medium 6.5

  • CVE-2024-43353

    WordPress myCred plugin <= 2.7.2 - Cross Site Scripting (XSS) vulnerability

    Medium 6.5

  • CVE-2024-32711

    WordPress myCred plugin <= 2.6.3 - Cross Site Scripting (XSS) vulnerability

    Medium 6.5

  • CVE-2026-17149

    myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripti

    Medium 6.4

  • CVE-2026-8607

    myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

    Medium 6.4

  • CVE-2026-0550

    myCred <= 2.9.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mycred_load_coupon' Shortcode

    Medium 6.4

  • CVE-2024-11201

    myCred – Loyalty Points and Rewards plugin <= 2.7.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via mycred_send Shortcode

    Medium 6.4

  • CVE-2021-25015→ 2.4

    myCred < 2.4 - Reflected Cross-Site Scripting

    Medium 6.1

  • CVE-2017-20008→ 1.7.8

    myCRED < 1.7.8 - Reflected Cross-Site Scripting

    Medium 6.1

  • CVE-2026-61968

    WordPress myCred plugin <= 3.1.2 - Broken Access Control vulnerability

    Medium 5.4

  • CVE-2024-10187

    myCred <= 2.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via mycred_link Shortcode

    Medium 5.4

  • CVE-2023-47853

    WordPress myCred Plugin <= 2.6.1 is vulnerable to Cross Site Scripting (XSS)

    Medium 5.4

  • CVE-2025-12362

    myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program <= 2.9.7 - Missing Authorization to Unauthenticated Withdrawal Request Ap

    Medium 5.3

  • CVE-2025-54667

    WordPress myCred plugin <= 2.9.4.3 - Race Condition Vulnerability

    Medium 5.3

  • CVE-2025-49872

    WordPress myCred plugin <= 2.9.4.2 - Broken Access Control Vulnerability

    Medium 5.3

  • CVE-2024-8658

    myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits fo

    Medium 5.3

  • CVE-2024-43214

    WordPress myCred plugin <= 2.7.2 - Sensitive Data Exposure vulnerability

    Medium 5.3

  • CVE-2026-24951

    WordPress myCred plugin <= 2.9.7.3 - Broken Access Control vulnerability

    Medium 4.3

  • CVE-2025-12361

    myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program <= 2.9.7.1 - Missing Authorization to Sensitive Information Exposure

    Medium 4.3

  • CVE-2025-49857

    WordPress myCred plugin <= 2.9.4.2 - Broken Access Control Vulnerability

    Medium 4.3

← Back to directory