Mycred

11 CVEs across 5 Mycred products. Browse Mycred vulnerabilities, severities, and proof-of-concept exploits.

Mycred products with known CVEs

ProductCVEs
Mycred7
Bookify1
License Manager For Woocommerce1
Mycred Elementor1
Mycred – Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin1
Mycred CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-56013Medium6.52026-06-25Unauthenticated Insecure Direct Object References (IDOR) in License Manager for WooCommerce <= 3.0.15 versions.
CVE-2026-40794Medium6.52026-06-15Subscriber Broken Access Control in myCred <= 3.0.3 versions.
CVE-2025-69332Medium6.52026-06-15Subscriber Broken Access Control in Bookify <= 1.1.1 versions.
CVE-2026-42676Medium6.52026-06-01Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in myCred allows Stored XSS. This issue affects myCred: fro…
CVE-2024-10187Medium6.42024-11-08The myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credi…
CVE-2024-49702Medium6.52024-10-24Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saad Iqbal myCred Elementor mycred-for-elementor allows S…
CVE-2024-8658Medium5.32024-09-25The myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credi…
CVE-2023-47853Medium6.52023-11-30Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in myCred myCred – Points, Rewards, Gamification, Ranks, Bad…
CVE-2023-35096Medium6.52023-07-17Cross-Site Request Forgery (CSRF) vulnerability in myCred plugin <= 2.5 versions.
CVE-2021-25015Medium6.12022-01-24The myCred WordPress plugin before 2.4 does not sanitise and escape the search query before outputting it back in the history dashboard page, leading to a Refl…
CVE-2017-20008Medium6.12021-11-29The myCred WordPress plugin before 1.7.8 does not sanitise and escape the user parameter before outputting it back in the Points Log admin dashboard, leading t…