Plugin icon

Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred

mycred

Vulnerabilities:

27

Last Updated:

March 11, 2026

Active Installs:

10000

Published
Title
Fixed in
CVSS
Published
2026-02-13
Title
myCred < 2.9.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mycred_load_coupon' Shortcode
Fixed in
Fixed in 2.9.7.4
CVSS
6.4 (medium)
Published
2026-02-06
Title
myCred < 2.9.7.4 - Missing Authorization
Fixed in
Fixed in 2.9.7.4
CVSS
4.3 (medium)
Published
2025-12-18
Title
myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program < 2.9.7.2 - Missing Authorization to Sensitive Information Exposure
Fixed in
Fixed in 2.9.7.2
CVSS
4.3 (medium)
Published
2025-12-12
Title
myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program < 2.9.7.1 - Missing Authorization to Unauthenticated Withdrawal Request Approval
Fixed in
Fixed in 2.9.7.1
CVSS
5.3 (medium)
Published
2025-11-08
Title
myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program. <= 2.9.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
No known fix
CVSS
5.5 (medium)
Published
2025-07-30
Title
myCred < 2.9.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 2.9.4.4
CVSS
6.4 (medium)
Published
2025-07-30
Title
myCred < 2.9.4.4 - Authenticated (Subscriber+) Race Condition
Fixed in
Fixed in 2.9.4.4
CVSS
4.3 (medium)
Published
2025-06-12
Title
myCred < 2.9.4.3 - Missing Authorization
Fixed in
Fixed in 2.9.4.3
CVSS
4.3 (medium)
Published
2025-06-12
Title
myCred < 2.9.4.3 - Missing Authorization
Fixed in
Fixed in 2.9.4.3
CVSS
5.3 (medium)
Published
2024-12-05
Title
myCred – Loyalty Points and Rewards plugin < 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via mycred_send Shortcode
Fixed in
Fixed in 2.7.6
CVSS
6.4 (medium)
Published
2024-11-07
Title
myCred < 2.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via mycred_link Shortcode
Fixed in
Fixed in 2.7.5
CVSS
6.4 (medium)
Published
2024-09-24
Title
myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits for Gamification < 2.7.4 - Missing Authorization to Unauthenticated Database Upgrade
Fixed in
Fixed in 2.7.4
CVSS
5.3 (medium)
Published
2024-08-16
Title
myCred < 2.7.3 - Unauthenticated PHP Object Injection
Fixed in
Fixed in 2.7.3
CVSS
8.1 (high)
Published
2024-08-16
Title
myCred < 2.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 2.7.3
CVSS
6.4 (medium)
Published
2024-08-09
Title
myCred < 2.7.3 - Unauthenticated Information Exposure
Fixed in
Fixed in 2.7.3
CVSS
5.3 (medium)
Published
2024-04-22
Title
myCred – Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin < 2.6.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Fixed in
Fixed in 2.6.4
CVSS
5.4 (medium)
Published
2023-11-20
Title
myCred < 2.6.2 - Contributor+ Stored XSS
Fixed in
Fixed in 2.6.2
CVSS
5.9 (medium)
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Fixed in
Fixed in 2.5.3
CVSS
6.1 (medium)
Published
2023-07-17
Title
myCred – Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin < 2.5.1 - Cross-Site Request Forgery
Fixed in
Fixed in 2.5.1
CVSS
5.4 (medium)
Published
2022-04-04
Title
Mycred < 2.4.4.1 - Subscriber+ User E-mail Addresses Disclosure
Fixed in
Fixed in 2.4.4.1
CVSS
6.5 (medium)
Published
2022-03-29
Title
myCred < 2.4.4 - Subscriber+ Import/Export to Email Address Disclosure
Fixed in
Fixed in 2.4.4
CVSS
6.5 (medium)
Published
2022-03-29
Title
myCred < 2.4.4 - Subscriber+ Arbitrary Post Creation
Fixed in
Fixed in 2.4.4
CVSS
4.3 (medium)
Published
2022-03-24
Title
myCred < 2.4.4 - Reflected Cross-Site Scripting
Fixed in
Fixed in 2.4.4
CVSS
6.1 (medium)
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Fixed in
Fixed in 2.4.3.1
CVSS
4.3 (medium)
Published
2021-12-27
Title
myCred < 2.4 - Reflected Cross-Site Scripting
Fixed in
Fixed in 2.4
CVSS
7.5 (high)
Published
2021-11-01
Title
myCred < 2.3 - Subscriber+ SQL Injection
Fixed in
Fixed in 2.3
CVSS
7.7 (high)
Published
2017-04-20
Title
myCRED < 1.7.8 - Reflected Cross-Site Scripting
Fixed in
Fixed in 1.7.8
CVSS
8.8 (high)