Skip to content
Sign in
Not rated

CVE-2017-20008 The myCred WordPress plugin before 1.7.8 does not sanitise and escape the user parameter before outputting it back in…

Description

The myCred WordPress plugin before 1.7.8 does not sanitise and escape the user parameter before outputting it back in the Points Log admin dashboard, leading to a Reflected Cross-Site Scripting

Affected products and versions

Product Affected versions Fixed in
myCred – Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin 1.7 earliest → < 1.7.8 1.7.8

Other CVEs of myCred – Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin

The 3 CVEs of myCred – Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin →
CVE-2021-25015 The myCred WordPress plugin before 2.4 does not sanitise and escape the search query before outputting it back in the… Not rated CVE-2021-24755 The myCred WordPress plugin before 2.3 does not validate or escape the fields parameter before using it in a SQL… Not rated
Track this CVE