Skip to content
Sign in
Not rated

CVE-2021-24755 The myCred WordPress plugin before 2.3 does not validate or escape the fields parameter before using it in a SQL…

Description

The myCred WordPress plugin before 2.3 does not validate or escape the fields parameter before using it in a SQL statement, leading to an SQL injection exploitable by any authenticated user

Affected products and versions

Product Affected versions Fixed in
myCred – Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin 2.3 earliest → < 2.3 2.3

Other CVEs of myCred – Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin

The 3 CVEs of myCred – Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin →
CVE-2021-25015 The myCred WordPress plugin before 2.4 does not sanitise and escape the search query before outputting it back in the… Not rated CVE-2017-20008 The myCred WordPress plugin before 1.7.8 does not sanitise and escape the user parameter before outputting it back in… Not rated
Track this CVE