MYCRED · CVE-2026-125778 · Package
NO FIX YET · SEE WHAT TO DO
The myCred plugin for WordPress fails to neutralize script-related HTML tags in a web page, a cross-site scripting flaw. An attacker who can inject that markup can run JavaScript in the browser of a visitor or administrator.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the myCred plugin through version 4.0.2 are in scope according to the NVD description. The sources do not say which input or role is needed to inject the markup, so exposure beyond the installed version is unknown.
Not affected if plugin-not-installed
Who cares mycred, wordpress
mycred plugin header4.0.2, the last version the advisory lists as affectedImproper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in myCred myCred mycred allows Code Injection.This issue affects myCred: from n/a through 4.0.2.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.