myCred WordPress plugin: Content injection via cross-site scripting
Summary
The myCred WordPress plugin up to and including version 4.0.2 contains a cross-site scripting flaw (CWE-80) that allows content injection. An attacker with a low-privileged account on the site, such as a subscriber or customer account, can insert unwanted content such as ads, scam or malware links into pages. The CNA rates the issue as medium (CVSS 4.3), and the vendor-independent advisory describes the impact as low with no known exploitation.
Affected
- myCred plugin for WordPress, all versions up to and including 4.0.2
- CVE-2026-123471 describes the same flaw and version range
Fixed in
- Update to myCred 4.0.3 or later (per Patchstack and third-party trackers; not yet confirmed in the official WordPress.org changelog)
Workaround
- No vendor workaround known.
- Limit accounts with contributor-type or higher rights until the update is applied.
Exploitation
- No evidence of exploitation in the wild as of 11 Nov 2026.
- No public proof-of-concept known as of 11 Nov 2026.
- CISA SSVC: exploitation none, automatable no, technical impact partial.
Our recommendation
- Update myCred to 4.0.3 or later on every WordPress site that uses it.
- Check whether any site still runs an older version.
- Note that other myCred flaws also affect versions up to 4.0.2, so the update is worth doing regardless of this issue.
- Restrict low-privileged account registration where possible and monitor pages for injected content.
- Track CVE-2026-125778 and CVE-2026-123471 together against the same fix.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory: WordPress myCred plugin <= 4.0.2 Content Injection patchstack.com
- CVE Record CVE-2026-125778 www.cve.org
- OffSeq Radar: CVE-2026-125778 radar.offseq.com
- VulDB: CVE-2026-125778 vuldb.com
- OpenCVE: CVE-2026-123471 (duplicate) app.opencve.io
- WordPress.org: myCred plugin wordpress.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 21:17.
Original description (NVD)
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in myCred myCred mycred allows Code Injection.This issue affects myCred: from n/a through 4.0.2.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.