Mycred

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Mycred product.

RSS Feeds for Mycred security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Mycred products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Mycred Sorted by Most Security Vulnerabilities since 2018

Mycred18 vulnerabilities

Mycred Bookify1 vulnerability

Mycred License Manager Woocommerce1 vulnerability

Mycred Elementor1 vulnerability

Mycred New User Approve1 vulnerability

By the Year

In 2026 there have been 6 vulnerabilities in Mycred with an average score of 6.3 out of ten. Last year, in 2025 Mycred had 2 security vulnerabilities published. That is, 4 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 1.50.

Year	Vulnerabilities	Average Score
2026	6	6.30
2025	2	4.80
2024	6	6.62
2023	2	7.10
2022	4	4.75
2021	2	7.45

It may take a day or so for new Mycred vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Mycred Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-28163	Aug 20, 2026	myCred New User Approve Missing Auth (3.2.8) Missing Authorization vulnerability in myCred New User Approve allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects New User Approve: from n/a through 3.2.8.	New User Approve
CVE-2026-56013	Jun 25, 2026	Unauth IDOR in License Manager for WooCommerce <=3.0.15 Unauthenticated Insecure Direct Object References (IDOR) in License Manager for WooCommerce <= 3.0.15 versions.	License Manager Woocommerce
CVE-2026-40794	Jun 15, 2026	myCred Broken Access Control <=3.0.3 (Subscriber) Subscriber Broken Access Control in myCred <= 3.0.3 versions.	Mycred
CVE-2025-69332	Jun 15, 2026	Bookify <=1.1.1 Subscriber BAccessCtrl Subscriber Broken Access Control in Bookify <= 1.1.1 versions.	Bookify
CVE-2026-42676	Jun 01, 2026	myCred <3.0.4: Stored XSS via Improper Input Neutralization Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in myCred allows Stored XSS. This issue affects myCred: from n/a through 3.0.4.	Mycred
CVE-2026-27440	Feb 19, 2026	Stored XSS in myCred <=2.9.7.6 (Saad Iqbal) Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saad Iqbal myCred mycred allows Stored XSS.This issue affects myCred: from n/a through <= 2.9.7.6.	Mycred
CVE-2025-12361	Dec 19, 2025	Missing Auth in myCred WP Plugin 2.9.7.1 get_bank_accounts AJAX The myCred Points Management System For Gamification, Ranks, Badges, and Loyalty Program plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.9.7.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve sensitive information including user IDs, display names, and email addresses of all users on the site via the get_bank_accounts AJAX action. Passwords are not exposed.	Mycred
CVE-2025-12362	Dec 13, 2025	Missing Auth in myCred WP Plugin v<=2.9.7 Allows Withdrawal Abuse The myCred Points Management System For Gamification, Ranks, Badges, and Loyalty Program plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.9.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to approve withdrawal requests, modify user point balances, and manipulate the payment processing system via the cashcred_pay_now AJAX action.	Mycred
CVE-2024-11201	Dec 06, 2024	Stored XSS via mycred_send in myCred <=2.7.5.2 The myCred Loyalty Points and Rewards plugin for WordPress and WooCommerce Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits for Gamification plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's mycred_send shortcode in all versions up to, and including, 2.7.5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	Mycred
CVE-2024-10187	Nov 08, 2024	myCred v2.7.4 XSS via Shortcode The myCred Loyalty Points and Rewards plugin for WordPress and WooCommerce Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits for Gamification plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's mycred_link shortcode in all versions up to, and including, 2.7.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	Mycred
CVE-2024-49702	Oct 24, 2024	XSS in myCred Elementor <=1.2.6 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saad Iqbal myCred Elementor mycred-for-elementor allows Stored XSS.This issue affects myCred Elementor: from n/a through <= 1.2.6.	Mycred Elementor
CVE-2024-8658	Sep 25, 2024	myCred 2.7.3 Unauthorized DB Update (missing capability check) The myCred Loyalty Points and Rewards plugin for WordPress and WooCommerce Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits for Gamification plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the mycred_update_database() function in all versions up to, and including, 2.7.3. This makes it possible for unauthenticated attackers to upgrade an out of date database.	Mycred
CVE-2024-43214	Aug 26, 2024	Missing Auth in myCred WP Plugin v2.7.2 Missing Authorization vulnerability in Saad Iqbal myCred mycred.This issue affects myCred: from n/a through <= 2.7.2.	Mycred
CVE-2024-43354	Aug 19, 2024	myCred Object Injection Deserialization Vulnerability Fix 2.7.3 Deserialization of Untrusted Data vulnerability in Saad Iqbal myCred mycred.This issue affects myCred: from n/a through <= 2.7.2.	Mycred
CVE-2023-47853	Nov 30, 2023	myCred Plugin 2.6.1 Stored XSS via Improper Input Neutralization Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in myCred myCred Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin allows Stored XSS.This issue affects myCred Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin: from n/a through 2.6.1.	Mycred
CVE-2023-35096	Jul 17, 2023	myCred <=2.5 CSRF Vulnerability Cross-Site Request Forgery (CSRF) vulnerability in myCred plugin <= 2.5 versions.	Mycred
CVE-2022-1092	Apr 25, 2022	The myCred WordPress plugin before 2.4.3.1 does not have authorisation and CSRF checks in its mycred-tools-import-export AJAX action The myCred WordPress plugin before 2.4.3.1 does not have authorisation and CSRF checks in its mycred-tools-import-export AJAX action, allowing any authenticated user to call and and retrieve the list of email address present in the blog	Mycred
CVE-2022-0287	Apr 25, 2022	The myCred WordPress plugin before 2.4.4.1 does not have any authorisation in place in its mycred-tools-select-user AJAX action The myCred WordPress plugin before 2.4.4.1 does not have any authorisation in place in its mycred-tools-select-user AJAX action, allowing any authenticated user, such as subscriber to call and retrieve all email addresses from the blog	Mycred
CVE-2022-0363	Apr 25, 2022	The myCred WordPress plugin before 2.4.3.1 does not have any authorisation and CSRF checks in the mycred-tools-import-export AJAX action The myCred WordPress plugin before 2.4.3.1 does not have any authorisation and CSRF checks in the mycred-tools-import-export AJAX action, allowing any authenticated users, such as subscribers, to call it and import mycred setup, thus creating badges, managing points or creating arbitrary posts.	Mycred
CVE-2021-25015	Jan 24, 2022	The myCred WordPress plugin before 2.4 does not sanitise and escape the search query before outputting it back in the history dashboard page The myCred WordPress plugin before 2.4 does not sanitise and escape the search query before outputting it back in the history dashboard page, leading to a Reflected Cross-Site Scripting issue	Mycred
CVE-2021-24755	Nov 29, 2021	The myCred WordPress plugin before 2.3 does not validate or escape the fields parameter before using it in a SQL statement The myCred WordPress plugin before 2.3 does not validate or escape the fields parameter before using it in a SQL statement, leading to an SQL injection exploitable by any authenticated user	Mycred
CVE-2017-20008	Nov 29, 2021	The myCred WordPress plugin before 1.7.8 does not sanitise and escape the user parameter before outputting it back in the Points Log admin dashboard The myCred WordPress plugin before 1.7.8 does not sanitise and escape the user parameter before outputting it back in the Points Log admin dashboard, leading to a Reflected Cross-Site Scripting	Mycred