WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
mycbgenie-clickbank-storefront
Published
2025-01-16
Title
ClickBank Storefront WordPress Plugin <= 1.7 - Reflected Cross-Site Scripting
Slug
mycred
Published
2021-11-01
Title
myCred < 2.3 - Subscriber+ SQL Injection
Slug
mycred
Published
2017-04-20
Title
myCRED < 1.7.8 - Reflected Cross-Site Scripting
Slug
mycred
Published
2021-12-27
Title
myCred < 2.4 - Reflected Cross-Site Scripting
Slug
mycred
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
mycred
Published
2022-03-29
Title
myCred < 2.4.4 - Subscriber+ Import/Export to Email Address Disclosure
Slug
mycred
Published
2022-03-29
Title
myCred < 2.4.4 - Subscriber+ Arbitrary Post Creation
Slug
mycred
Published
2022-04-04
Title
Mycred < 2.4.4.1 - Subscriber+ User E-mail Addresses Disclosure
Slug
mycred
Published
2022-03-24
Title
myCred < 2.4.4 - Reflected Cross-Site Scripting
Slug
mycred
Published
2023-07-17
Title
myCred – Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin < 2.5.1 - Cross-Site Request Forgery
Slug
mycred
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
mycred
Published
2023-11-20
Title
myCred < 2.6.2 - Contributor+ Stored XSS
Slug
mycred
Published
2024-04-22
Title
myCred – Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin < 2.6.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Slug
mycred
Published
2024-08-09
Title
myCred < 2.7.3 - Unauthenticated Information Exposure
Slug
mycred
Published
2024-08-16
Title
myCred < 2.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
mycred
Published
2024-08-16
Title
myCred < 2.7.3 - Unauthenticated PHP Object Injection
Slug
mycred
Published
2024-09-24
Title
myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits for Gamification < 2.7.4 - Missing Authorization to Unauthenticated Database Upgrade
Slug
mycred
Published
2024-11-07
Title
myCred < 2.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via mycred_link Shortcode
Slug
mycred
Published
2024-12-05
Title
myCred – Loyalty Points and Rewards plugin < 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via mycred_send Shortcode
Slug
mycred
Published
2025-06-12
Title
myCred < 2.9.4.3 - Missing Authorization
Slug
mycred
Published
2025-06-12
Title
myCred < 2.9.4.3 - Missing Authorization
Slug
mycred
Published
2025-07-30
Title
myCred < 2.9.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
mycred
Published
2025-07-30
Title
myCred < 2.9.4.4 - Authenticated (Subscriber+) Race Condition
Slug
mycred
Published
2025-12-12
Title
myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program < 2.9.7.1 - Missing Authorization to Unauthenticated Withdrawal Request Approval
Slug
mycred
Published
2025-12-18
Title
myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program < 2.9.7.2 - Missing Authorization to Sensitive Information Exposure