CVE-2024-10187: 
WordPress vulnerability analysis and mitigation

The myCred WordPress plugin (versions up to 2.7.4) contains a Stored Cross-Site Scripting vulnerability in the mycred_link shortcode functionality. The vulnerability was discovered and disclosed on November 7, 2024, affecting the myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce (NVD).

The vulnerability stems from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's mycred_link shortcode. The issue has been assigned a CVSS v3.1 base score of 5.4 (Medium) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N according to NVD, while Wordfence assessed it with a score of 6.4 (Medium) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N (NVD).

The vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page (NVD).

The vulnerability requires an authenticated user with at least contributor-level privileges to exploit. The attack complexity is considered low, requiring no special conditions or circumstances for exploitation (NVD).

Users should upgrade to version 2.7.5 or later of the myCred plugin to address this vulnerability. A patch has been released and is available through the WordPress plugin repository (WordPress Plugin).