{"id":"CVE-2026-125778","kind":"vulnerability","aliases":["CVE-2026-125778"],"related":[],"title":"myCred WordPress plugin: stored XSS through script tags in pages","description":"Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in myCred myCred mycred allows Code Injection.This issue affects myCred: from n/a through 4.0.2.","summary":"The myCred plugin for WordPress fails to neutralize script-related HTML tags in a web page, a cross-site scripting flaw. An attacker who can inject that markup can run JavaScript in the browser of a visitor or administrator.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"mycred","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["mycred","package","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed myCred version in the WordPress plugins screen or the `mycred` plugin header","fix":"- Move myCred to a version later than `4.0.2`, the last version the advisory lists as affected","status":"open","published_at":"2026-11-11T13:17:23+00:00","first_seen_at":"2026-11-11T13:27:15+00:00","triaged_at":"2026-11-11T13:29:46+00:00","updated_at":"2026-11-11T13:29:46+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-11T13:29:46Z","model":"claude-haiku-5-5","output":{"fix":"- Move myCred to a version later than `4.0.2`, the last version the advisory lists as affected\n- unknown","reach":"internet","title":"myCred WordPress plugin: stored XSS through script tags in pages","impact":"medium","summary":"The myCred plugin for WordPress fails to neutralize script-related HTML tags in a web page, a cross-site scripting flaw. An attacker who can inject that markup can run JavaScript in the browser of a visitor or administrator.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","mycred"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs JavaScript in visitor or admin browsers","analyst_note":"Confirm the affected input, required role and fixed version from the NVD entry and the myCred changelog.","how_to_check":"- Check the installed myCred version in the WordPress plugins screen or the `mycred` plugin header\n- unknown","plain_action":"","product_name":"mycred","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the myCred plugin through version 4.0.2 are in scope according to the NVD description. The sources do not say which input or role is needed to inject the markup, so exposure beyond the installed version is unknown.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000716,"input_tokens":4544,"output_tokens":523,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125778':13A,16A '-2026':12A,15A '4.0.2':90C 'administr':61B 'affect':85C 'allow':81C 'attack':45B 'basic':74C 'browser':56B 'code':82C 'cross':40B 'cross-sit':39B 'cve':11A,14A 'fail':26B 'flaw':43B 'html':32B,68C 'improp':62C 'inject':48B 'injection.this':83C 'issu':84C 'javascript':53B 'markup':50B 'mycr':1A,18B,22B,78C,79C,80C,86C 'mycred':17A 'n/a':88C 'neutral':28B,63C 'packag':19B 'page':10A,37B,73C 'plugin':3A,23B 'relat':31B,67C 'run':52B 'script':7A,30B,42B,66C 'script-rel':29B,65C 'site':41B 'store':4A 'tag':8A,33B,69C 'visitor':59B 'vulner':76C 'web':36B,72C 'wordpress':2A,20B,25B 'xss':5A,75C","nicknames":[],"mitigations":[],"who_affected":"Sites running the myCred plugin through version 4.0.2 are in scope according to the NVD description. The sources do not say which input or role is needed to inject the markup, so exposure beyond the installed version is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["mycred"],"ptokens":["mycred"],"labels":["medium","mycred","package","vendor","wordpress"],"campaign_type":null,"search_a":"'-125778':13A,16A '-2026':12A,15A 'cve':11A,14A 'mycr':1A 'mycred':17A 'page':10A 'plugin':3A 'script':7A 'store':4A 'tag':8A 'wordpress':2A 'xss':5A","search_b":"'administr':61B 'attack':45B 'browser':56B 'cross':40B 'cross-sit':39B 'fail':26B 'flaw':43B 'html':32B 'inject':48B 'javascript':53B 'markup':50B 'mycr':18B,22B 'neutral':28B 'packag':19B 'page':37B 'plugin':23B 'relat':31B 'run':52B 'script':30B,42B 'script-rel':29B 'site':41B 'tag':33B 'visitor':59B 'web':36B 'wordpress':20B,25B","search_c":"'4.0.2':90C 'affect':85C 'allow':81C 'basic':74C 'code':82C 'html':68C 'improp':62C 'injection.this':83C 'issu':84C 'mycr':78C,79C,80C,86C 'n/a':88C 'neutral':63C 'page':73C 'relat':67C 'script':66C 'script-rel':65C 'tag':69C 'vulner':76C 'web':72C 'xss':75C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T13:17:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125778","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125778","severity":null,"published_at":"2026-11-11T13:17:23+00:00","modified_at":"2026-11-11T13:17:23+00:00","first_seen_at":"2026-11-11T13:27:15+00:00","fetched_at":"2026-11-11T13:27:15+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}