PT-2024-16102 · WordPress · Mycred

Peter Thaleikis

·

Published

2024-11-08

·

Updated

2024-11-13

·

CVE-2024-10187

CVSS v3.1

6.4

Medium

VectorAV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce versions up to, and including, 2.7.4
Description The myCred plugin is vulnerable to Stored Cross-Site Scripting via the plugin's mycred link shortcode due to insufficient input sanitization and output escaping on user-supplied attributes. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Recommendations For versions up to, and including, 2.7.4, update to the latest version to mitigate risks. As a temporary workaround, consider restricting access to the mycred link shortcode to minimize the risk of exploitation. Avoid using the mycred link shortcode in pages until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-10187

Affected Products

Mycred