CVE-2026-42676

Vulnerability

The myCred plugin for WordPress is susceptible to a stored cross-site scripting (XSS) vulnerability due to improper neutralization of user-supplied input during web page generation. This flaw affects all versions of the plugin from n/a through 3.0.4 [2].

Exploitation

Successful exploitation requires a privileged user to interact with a malicious link, visit a crafted page, or submit a form. Once the malicious payload is stored, the injected script executes in the context of the victim's browser when they visit the affected page [2].

Impact

An attacker can inject malicious scripts, including redirects, advertisements, and other HTML payloads, into the website. This can lead to unauthorized actions performed on behalf of the user or the compromise of site content viewed by guests [2].

Mitigation

Users should update the myCred plugin to version 3.0.5 or later to resolve this vulnerability [2]. If an immediate update is not possible, site administrators should consult with their hosting provider or web developer for assistance in applying security mitigations.