CVE-2023-47853 WordPress myCred Plugin <= 2.6.1 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in myCred myCred – Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin allows Stored XSS.This issue affects myCred – Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin: from n/a...

PT-2023-30647 · WordPress · Mycred

Name of the Vulnerable Software and Affected Versions: myCred – Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin versions through 2.6.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows...

myCred < 2.6.2 - Contributor+ Stored XSS

Description The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

WordPress myCred Plugin <= 2.6.1 is vulnerable to Cross Site Scripting (XSS)

Software myCred Type Plugin Vulnerable versions = 2.6.1 Fixed in 2.6.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-47853 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 7a775c0398b7 Credits Khalid Yusuf Required privilege Contributor...

CVE-2023-35096

Cross-Site Request Forgery CSRF vulnerability in myCred plugin = 2.5 versions...

CVE-2023-35096

Cross-Site Request Forgery CSRF vulnerability in myCred plugin = 2.5 versions...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in myCred plugin = 2.5 versions...

CVE-2023-35096

The CVE-2023-35096 CSRF flaw affects the WordPress myCred plugin ≤ 2.5. It allows CSRF actions to be performed on behalf of authenticated users; exploitation would require user interaction. The issue is mitigated by upgrading to 2.5.1 or later (fix implemented). If upgrading is not possible, cons...

CVE-2023-35096 WordPress myCred Plugin <= 2.5 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in myCred plugin = 2.5 versions...

CVE-2023-35096 WordPress myCred Plugin <= 2.5 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in myCred plugin = 2.5 versions...

PT-2023-25145 · WordPress · Mycred

Name of the Vulnerable Software and Affected Versions: myCred plugin versions = 2.5 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web application that the...

WordPress myCred Plugin <= 2.5 is vulnerable to Cross Site Request Forgery (CSRF)

Software myCred Type Plugin Vulnerable versions = 2.5 Fixed in 2.5.1 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-35096 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 50793719ef32 Credits István Márton Required privile...

CVE-2022-1092

The myCred WordPress plugin before 2.4.3.1 does not have authorisation and CSRF checks in its mycred-tools-import-export AJAX action, allowing any authenticated user to call and and retrieve the list of email address present in the blog...

CVE-2022-1092

The myCred WordPress plugin before 2.4.3.1 does not have authorisation and CSRF checks in its mycred-tools-import-export AJAX action, allowing any authenticated user to call and and retrieve the list of email address present in the blog...

CVE-2022-0363

The myCred WordPress plugin before 2.4.3.1 does not have any authorisation and CSRF checks in the mycred-tools-import-export AJAX action, allowing any authenticated users, such as subscribers, to call it and import mycred setup, thus creating badges, managing points or creating arbitrary posts...

CVE-2022-0287

The myCred WordPress plugin before 2.4.4.1 does not have any authorisation in place in its mycred-tools-select-user AJAX action, allowing any authenticated user, such as subscriber to call and retrieve all email addresses from the blog...

Cross site request forgery (csrf)

The myCred WordPress plugin before 2.4.3.1 does not have any authorisation and CSRF checks in the mycred-tools-import-export AJAX action, allowing any authenticated users, such as subscribers, to call it and import mycred setup, thus creating badges, managing points or creating arbitrary posts...

CVE-2022-0363 myCred < 2.4.4 - Subscriber+ Arbitrary Post Creation

The myCred WordPress plugin before 2.4.3.1 does not have any authorisation and CSRF checks in the mycred-tools-import-export AJAX action, allowing any authenticated users, such as subscribers, to call it and import mycred setup, thus creating badges, managing points or creating arbitrary posts...

CVE-2022-0287 Mycred < 2.4.4.1 - Subscriber+ User E-mail Addresses Disclosure

The myCred WordPress plugin before 2.4.4.1 does not have any authorisation in place in its mycred-tools-select-user AJAX action, allowing any authenticated user, such as subscriber to call and retrieve all email addresses from the blog...

PT-2022-13127 · WordPress · Mycred

Name of the Vulnerable Software and Affected Versions: myCred WordPress plugin versions prior to 2.4.3.1 Description: The issue concerns the lack of authorization and CSRF checks in the mycred-tools-import-export AJAX action. This allows any authenticated users, such as subscribers, to call the...