Medium
CVE-2026-17149
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 35
Reset filters
Medium
CVE-2026-15150
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred < 3.2.5 - Unauthenticated Payment Bypass
Medium
CVE-2026-61968
myCred <= 3.1.2 - Missing Authorization
Medium
CVE-2026-8607
myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrap' Shortcode Attribute
Medium
CVE-2026-42676
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred <= 3.0.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2026-40794
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred <= 3.0.3 - Missing Authorization
Medium
CVE-2026-0550
myCred <= 2.9.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mycred_load_coupon' Shortcode
Medium
CVE-2026-24951
myCred <= 2.9.7.3 - Missing Authorization
Medium
CVE-2025-12361
myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program <= 2.9.7.1 - Missing Authorization to Sensitive Information Exposure
Medium
CVE-2025-12362
myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program <= 2.9.7 - Missing Authorization to Unauthenticated Withdrawal Request Approval
Medium
CVE-2026-27440
myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program. <= 2.9.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-54667
myCred <= 2.9.4.3 - Authenticated (Subscriber+) Race Condition
Medium
CVE-2025-54668
myCred <= 2.9.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-49857
myCred <= 2.9.4.2 - Missing Authorization
Medium
CVE-2025-49872
myCred <= 2.9.4.2 - Missing Authorization
Medium
CVE-2024-11201
myCred – Loyalty Points and Rewards plugin <= 2.7.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via mycred_send Shortcode
Medium
CVE-2024-10187
myCred <= 2.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via mycred_link Shortcode
Medium
CVE-2024-49702
myCred Elementor <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2024-8658
myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits for Gamification <= 2.7.3 - Missing Authorization to Unauthenticated Database Upgrade
Medium
CVE-2024-43353
myCred <= 2.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2024-43354
myCred <= 2.7.2 - Unauthenticated PHP Object Injection
Medium
CVE-2024-43214
myCred <= 2.7.2 - Unauthenticated Information Exposure
Medium
CVE-2024-32711
myCred – Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin <= 2.6.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2023-47853
myCred <= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.