myCred vulnerabilities and threats

13 threats

Severity	CVSS	Signals	Threat	Source	Published
High	7.5	EPSS 0.3%	CVE-2026-123465myCred (WordPress plugin) · Exposure of Sensitive System Information to an Unauthorized Control Sphere High7.5EPSS 0.3%2026-11-09CVE Database V5CVE-2026-123465 Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in myCred myCred mycred allows Retrieve Embedded Sensitive Data.This issue affects myCred: from n/a through 4.0.2. EPSS 0.3%Vulnerability	CVE Database V5	2026-11-09
Medium	5.3	EPSS 0.3%	CVE-2026-123462myCred (WordPress plugin) · Missing Authorization Medium5.3EPSS 0.3%2026-11-07CVE Database V5CVE-2026-123462 Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2. EPSS 0.3%Vulnerability	CVE Database V5	2026-11-07
Medium	4.3	EPSS 0.2%	CVE-2026-122668myCred (WordPress plugin) · Missing Authorization Medium4.3EPSS 0.2%2026-11-07CVE Database V5CVE-2026-122668 Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2. EPSS 0.2%Vulnerability	CVE Database V5	2026-11-07
Medium	5.3	EPSS 0.2%	CVE-2026-124274myCred (WordPress plugin) · Missing Authorization Medium5.3EPSS 0.2%2026-11-07CVE Database V5CVE-2026-124274 Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2. EPSS 0.2%Vulnerability	CVE Database V5	2026-11-07
Medium	4.3	EPSS 0.2%	CVE-2026-123471myCred (WordPress plugin) · Basic XSS Medium4.3EPSS 0.2%2026-11-06CVE Database V5CVE-2026-123471 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in myCred myCred mycred allows Code Injection.This issue affects myCred: from n/a through 4.0.2. EPSS 0.2%Vulnerability	CVE Database V5	2026-11-06
Medium	4.3	EPSS 0.2%	CVE-2026-97072myCred (WordPress plugin) · Missing Authorization Medium4.3EPSS 0.2%2026-11-03CVE Database V5CVE-2026-97072 CVE-2026-97072 is a missing authorization vulnerability in the myCred plugin affecting versions prior to 4.0.3. It allows exploitation due to incorrectly configured access control security levels, potentially leading to unauthorized actions. The issue is fixed in version 4.0.3. EPSS 0.2%Vulnerability	CVE Database V5	2026-11-03
Medium	4.3	EPSS 0.2%	CVE-2026-103077myCred (WordPress plugin) · Missing Authorization Medium4.3EPSS 0.2%2026-11-03CVE Database V5CVE-2026-103077 Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2. EPSS 0.2%Vulnerability	CVE Database V5	2026-11-03
Medium	5.3	EPSS 0.3%	CVE-2026-97073myCred (WordPress plugin) · Missing Authorization Medium5.3EPSS 0.3%2026-10-29CVE Database V5CVE-2026-97073 CVE-2026-97073 is a missing authorization vulnerability in the myCred plugin affecting versions before 4.0.3. This flaw allows unauthorized access due to incorrectly configured access control security levels. The issue is fixed in version 4.0.3. The vulnerability has a medium severity score of 5.3 and does not require user interaction or privileges to exploit. EPSS 0.3%Vulnerability	CVE Database V5	2026-10-29
Medium	4.3	EPSS 0.3%	CVE-2026-115962myCred (WordPress plugin) · Authentication Bypass by Spoofing Medium4.3EPSS 0.3%2026-10-29CVE Database V5CVE-2026-115962 CVE-2026-115962 is an authentication bypass vulnerability in the myCred plugin that allows identity spoofing. This flaw affects myCred versions from the initial release up to 4.0.1. The issue was fixed in version 4.0.2. The vulnerability has a medium severity rating with a CVSS score of 4.3, indicating limited impact primarily on integrity without confidentiality or availability effects. EPSS 0.3%Vulnerability	CVE Database V5	2026-10-29
Medium	5.4	EPSS 0.2%	CVE-2026-114698myCred (WordPress plugin) · Insecure Direct Object Reference Medium5.4EPSS 0.2%2026-10-22CVE Database V5CVE-2026-114698 CVE-2026-114698 is an authorization bypass vulnerability in the myCred plugin affecting versions prior to 4.0.0. It allows attackers with limited privileges to exploit incorrectly configured access control security levels by manipulating a user-controlled key. This flaw can lead to integrity and availability impacts but does not affect confidentiality. The issue is fixed in version 4.0.0. EPSS 0.2%Vulnerability	CVE Database V5	2026-10-22
Medium	5.3	EPSS 0.3%	CVE-2026-28163New User Approve (WordPress plugin) · Missing Authorization Medium5.3EPSS 0.3%2026-08-20CVE Database V5CVE-2026-28163 CVE-2026-28163 is a missing authorization vulnerability in the myCred New User Approve plugin. It allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized actions. The issue affects versions up to 3.2.8. The vulnerability has a medium severity with a CVSS score of 5.3. EPSS 0.3%Vulnerability myCred CWE-862	CVE Database V5	2026-08-20
Medium	6.5	EPSS 0.3%	CVE-2026-56013License Manager for WooCommerce (WordPress plugin) · Insecure Direct Object Reference Medium6.5EPSS 0.3%2026-06-25CVE Database V5CVE-2026-56013 Unauthenticated Insecure Direct Object References (IDOR) in License Manager for WooCommerce <= 3.0.15 versions. EPSS 0.3%Vulnerability myCred CWE-639	CVE Database V5	2026-06-25
Medium	6.5	EPSS 0.3%	CVE-2025-69332Bookify (WordPress plugin) · Missing Authorization Medium6.5EPSS 0.3%2026-06-15CVE Database V5CVE-2025-69332 Subscriber Broken Access Control in Bookify <= 1.1.1 versions. EPSS 0.3%Vulnerability myCred CWE-862	CVE Database V5	2026-06-15

Page 1 of 1