WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
mycred
Published
2026-02-06
Title
myCred < 2.9.7.4 - Missing Authorization
Slug
mycred
Published
2026-02-13
Title
myCred < 2.9.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mycred_load_coupon' Shortcode
Slug
mycred
Published
2025-11-08
Title
myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program. < 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
mycred
Published
2026-04-24
Title
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred < 3.0.4 - Missing Authorization
Slug
mycred
Published
2026-05-15
Title
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred < 3.0.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Slug
mycred
Published
2026-06-16
Title
myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program < 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrap' Shortcode Attribute
Slug
mycred-for-elementor
Published
2024-10-21
Title
myCred Elementor < 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
mycryptocheckout
Published
2023-04-06
Title
MyCryptoCheckout < 2.124 - Reflected XSS
Slug
mycryptocheckout
Published
2023-09-04
Title
MyCryptoCheckout < 2.126 - CSRF
Slug
mycryptocheckout
Published
2026-05-12
Title
MyCryptoCheckout – Bitcoin, Ethereum, and 100+ altcoins for WooCommerce < 2.162 - Missing Authorization
Slug
mycss
Published
2022-06-06
Title
MyCSS <= 1.1 - Arbitrary Settings Update via CSRF
Slug
mycurator
Published
2023-07-11
Title
MyCurator Content Curation < 3.75 - Cross-Site Request Forgery
Slug
mycurator
Published
2024-03-18
Title
MyCurator Content Curation < 3.77 - Reflected Cross-Site Scripting
Slug
mycurator
Published
2024-11-01
Title
MyCurator Content Curation < 3.79 - Authenticated (Editor+) Stored Cross-Site Scripting
Slug
mycustomwidget
Published
2025-04-25
Title
My Custom Widgets <= 2.0.5 - Reflected Cross-Site Scripting
Slug
myd-delivery
Published
2025-12-31
Title
MyD Delivery <= 1.3.7 - Unauthenticated Insecure Direct Object Reference
Slug
myeasybackup
Published
2012-01-16
Title
myEASYbackup <= 1.0.8.1 - Directory Traversal
Slug
myflash
Published
2014-08-01
Title
Myflash <= 1.00 - (wppath) RFI
Slug
myflash
Published
2014-08-01
Title
Myflash - myextractXML.php path Parameter Arbitrary File Access
Slug
myftp-ftp-like-plugin-for-wordpress
Published
2014-08-01
Title
myftp-ftp-like-plugin-for-wordpress v2 - SQL Injection
Slug
mygallery
Published
2007-04-29
Title
myGallery <= 1.4b4 - Unauthenticated File Inclusion
Slug
myhome-core
Published
2026-01-21
Title
MyHome Core < 4.1.1 - Unauthenticated Local File Inclusion
Slug
mylco
Published
2025-12-05
Title
myLCO <= 0.8.1 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']
Slug
mylinksdump
Published
2014-08-01
Title
myLDlinker - SQL Injection
Slug
mylinksdump
Published
2026-03-20
Title
myLinksDump <= 1.6 - Authenticated (Administrator+) SQL Injection via 'sort_by' and 'sort_order' Parameters