CVE-2026-0550 is a stored cross-site scripting vulnerability in the myCred plugin for WordPress, specifically in the 'mycred_load_coupon' shortcode. The issue stems from improper neutralization of input during web page generation, where user-supplied attributes are not adequately sanitized or escaped. Authenticated attackers with contributor or higher privileges can exploit this to inject arbitrary JavaScript that executes in the context of users visiting the compromised page. This vulnerability affects all plugin versions up to and including 2.9.7.3.

Successful exploitation allows an attacker with contributor-level access or higher to inject persistent malicious scripts into pages using the vulnerable shortcode. This can lead to unauthorized actions performed on behalf of users, theft of session tokens or credentials, and potential compromise of user accounts. The impact is limited to confidentiality and integrity with no direct availability impact. The CVSS score of 6.4 reflects a medium severity level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the 'mycred_load_coupon' shortcode if feasible. Monitor for plugin updates from the vendor addressing this vulnerability.