Logo
Retour à la veille

CVE-2026-17149

Publié : 9 septembre 2026
Modifié : 9 septembre 2026
Lien officiel NVD
Score CVSS
6.4
MEDIUM

Description détaillée

The Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute in all versions up to, and including, 3.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Références et Patchs

https://plugins.trac.wordpress.org/browser/mycred/tags/3.2.0/addons/sell-content/includes/mycred-sell-shortcodes.php#L152https://plugins.trac.wordpress.org/browser/mycred/tags/3.2.0/addons/sell-content/includes/mycred-sell-shortcodes.php#L163https://plugins.trac.wordpress.org/browser/mycred/tags/3.2.0/addons/sell-content/myCRED-addon-sell-content.php#L69https://plugins.trac.wordpress.org/browser/mycred/tags/3.2.3/addons/sell-content/includes/mycred-sell-shortcodes.php#L152https://plugins.trac.wordpress.org/browser/mycred/tags/3.2.3/addons/sell-content/includes/mycred-sell-shortcodes.php#L163https://plugins.trac.wordpress.org/browser/mycred/tags/3.2.3/addons/sell-content/myCRED-addon-sell-content.php#L69https://plugins.trac.wordpress.org/changeset?reponame=&old=3640734%40mycred&new=3640734%40mycredhttps://www.wordfence.com/threat-intel/vulnerabilities/id/9d8c7e79-00c4-4667-9ef6-e988901bb6a0?source=cve

Dernières Vulnérabilités

CVE-2026-19733

Server-Side request forgery (SSRF) vulnerability in Yordam Informatics Technology Consulting, Training, and Electronic Systems Industry and Trade Inc. Library Information and Document Automation Program allows Server Side Request Forgery. This issue affects Library Information and Document Automation Program: before v22.2.

VOIR DÉTAILS

CVE-2026-11838

Missing authentication for critical function vulnerability in Yordam Informatics Technology Consulting, Training, and Electronic Systems Industry and Trade Inc. Library Reservation System allows Input Data Manipulation. This issue affects Library Reservation System: before v22.2.

VOIR DÉTAILS

CVE-2025-3271

Documentum Webtop versions prior to 16.7.1 software is vulnerable to an XSS

VOIR DÉTAILS