{"id":"CVE-2026-125809","kind":"vulnerability","aliases":["CVE-2026-125809"],"related":[],"title":"myCred WordPress plugin: stored cross-site scripting through version 4.0.2","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in myCred myCred mycred allows Stored XSS.This issue affects myCred: from n/a through 4.0.2.","summary":"The myCred plugin for WordPress fails to neutralize user input on generated pages, allowing stored cross-site scripting. An attacker who can submit that input can run scripts in the browser of anyone who views the affected page, such as an administrator.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"mycred","fixed":[],"affected":"","ecosystem":"composer"}],"ecosystems":["composer"],"tags":["mycred","package","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed myCred version in the WordPress plugin list or the `mycred` plugin header; the sources say versions through `4.0.2` are affected","fix":"- Move to a myCred release newer than `4.0.2`; the sources do not name the fixed version","status":"open","published_at":"2026-11-13T15:17:40+00:00","first_seen_at":"2026-11-13T15:46:18+00:00","triaged_at":"2026-11-13T15:48:48+00:00","updated_at":"2026-11-13T15:48:48+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-13T15:48:48Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a myCred release newer than `4.0.2`; the sources do not name the fixed version","reach":"internet","title":"myCred WordPress plugin: stored cross-site scripting through version 4.0.2","impact":"medium","summary":"The myCred plugin for WordPress fails to neutralize user input on generated pages, allowing stored cross-site scripting. An attacker who can submit that input can run scripts in the browser of anyone who views the affected page, such as an administrator.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","mycred"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker scripts run in victims' browsers, including administrators","analyst_note":"Confirm the fixed version and the required privilege level from the NVD or vendor advisory page for CVE-2026-125809.","how_to_check":"- Check the installed myCred version in the WordPress plugin list or the `mycred` plugin header; the sources say versions through `4.0.2` are affected\n- unknown","plain_action":"","product_name":"mycred","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the myCred plugin at version 4.0.2 or earlier are affected according to the sources. Exposure depends on which users can submit content that is later rendered to other visitors, which the sources do not detail. Sites without myCred can skip it.","user_interaction":"unknown","product_ecosystem":"composer","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000732,"input_tokens":4536,"output_tokens":556,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125809':14A,17A '-2026':13A,16A '4.0.2':11A,91C 'administr':64B 'affect':59B,86C 'allow':35B,82C 'anyon':55B 'attack':42B 'browser':53B 'cross':6A,38B,74C 'cross-sit':5A,37B,73C 'cve':12A,15A 'fail':27B 'generat':33B,72C 'improp':65C 'input':31B,47B,68C 'issu':85C 'mycr':1A,19B,23B,79C,80C,81C,87C 'mycred':18A 'n/a':89C 'neutral':29B,66C 'packag':20B 'page':34B,60B,71C 'plugin':3A,24B 'run':49B 'script':8A,40B,50B,76C 'site':7A,39B,75C 'store':4A,36B,83C 'submit':45B 'user':30B 'version':10A 'view':57B 'vulner':77C 'web':70C 'wordpress':2A,21B,26B 'xss.this':84C","nicknames":[],"mitigations":[],"who_affected":"Sites running the myCred plugin at version 4.0.2 or earlier are affected according to the sources. Exposure depends on which users can submit content that is later rendered to other visitors, which the sources do not detail. Sites without myCred can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["mycred"],"ptokens":["mycred"],"labels":["composer","medium","mycred","package","wordpress"],"campaign_type":null,"search_a":"'-125809':14A,17A '-2026':13A,16A '4.0.2':11A 'cross':6A 'cross-sit':5A 'cve':12A,15A 'mycr':1A 'mycred':18A 'plugin':3A 'script':8A 'site':7A 'store':4A 'version':10A 'wordpress':2A","search_b":"'administr':64B 'affect':59B 'allow':35B 'anyon':55B 'attack':42B 'browser':53B 'cross':38B 'cross-sit':37B 'fail':27B 'generat':33B 'input':31B,47B 'mycr':19B,23B 'neutral':29B 'packag':20B 'page':34B,60B 'plugin':24B 'run':49B 'script':40B,50B 'site':39B 'store':36B 'submit':45B 'user':30B 'view':57B 'wordpress':21B,26B","search_c":"'4.0.2':91C 'affect':86C 'allow':82C 'cross':74C 'cross-sit':73C 'generat':72C 'improp':65C 'input':68C 'issu':85C 'mycr':79C,80C,81C,87C 'n/a':89C 'neutral':66C 'page':71C 'script':76C 'site':75C 'store':83C 'vulner':77C 'web':70C 'xss.this':84C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T15:17:40+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125809","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125809","severity":null,"published_at":"2026-11-13T15:17:40+00:00","modified_at":"2026-11-13T15:17:41+00:00","first_seen_at":"2026-11-13T15:46:18+00:00","fetched_at":"2026-11-13T15:46:18+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}