CVE-2026-0550: WordPress myCred Plugin XSS Vulnerability

CVE-2026-0550 Overview

The myCred plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the plugin's mycred_load_coupon shortcode in all versions up to, and including, 2.9.7.3. The vulnerability exists due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Critical Impact

Authenticated attackers with contributor-level access can inject persistent malicious scripts that execute in the browsers of any user viewing affected pages, potentially leading to session hijacking, credential theft, or further site compromise.

Affected Products

• myCred WordPress plugin versions up to and including 2.9.7.3
• WordPress sites using the mycred_load_coupon shortcode functionality
• Any page or post utilizing the vulnerable shortcode attributes

Discovery Timeline

• 2026-02-14 - CVE CVE-2026-0550 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2026-0550

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability resides in the myCred plugin's coupon shortcode functionality. The mycred_load_coupon shortcode fails to properly sanitize user-supplied attributes before rendering them in the page output. When an authenticated user with at least contributor-level privileges crafts a malicious shortcode with script payloads embedded in the attributes, those scripts are stored in the database and executed whenever any user views the page containing the shortcode.

The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), which is one of the most common web application security flaws. The stored nature of this XSS makes it particularly dangerous as the payload persists and affects all users who view the compromised page.

Root Cause

The root cause of this vulnerability is the lack of proper input sanitization and output escaping within the mycred-coupon-shortcodes.php file. The shortcode handler accepts user-controllable attributes without adequately validating or encoding them before including them in the HTML output. This allows script tags and JavaScript event handlers to pass through the sanitization layer and be rendered as executable code in the browser.

Attack Vector

The attack vector requires network access and authenticated access at the contributor level or above. An attacker must be able to create or edit posts/pages on the target WordPress site. Once the malicious shortcode is inserted, the payload is delivered to victims through normal page browsing. The attack does not require user interaction beyond viewing the compromised page, making it effective for targeting administrators and other users who may visit the infected content.

The vulnerability mechanism exploits improper attribute handling in the mycred_load_coupon shortcode. When processing shortcode attributes, the plugin fails to apply adequate escaping functions such as esc_attr() or wp_kses() before output. Attackers can craft shortcode attributes containing JavaScript payloads that execute in the context of authenticated sessions. For technical implementation details, see the WordPress Plugin Change Log.

Detection Methods for CVE-2026-0550

Indicators of Compromise

• Unusual JavaScript or HTML tags present in post content containing the mycred_load_coupon shortcode
• Unexpected script execution or browser alerts when viewing pages with coupon functionality
• Database entries in wp_posts containing suspicious shortcode attribute values
• User reports of unexpected behavior or redirects when viewing coupon-related pages

Detection Strategies

• Implement web application firewall (WAF) rules to detect XSS patterns in shortcode attributes
• Regularly audit post content in the database for suspicious JavaScript or HTML injection patterns
• Monitor WordPress user activity logs for contributors creating or editing posts with coupon shortcodes
• Deploy browser-based XSS detection tools that alert on unexpected script execution

Monitoring Recommendations

• Enable detailed logging for WordPress post creation and modification events
• Configure SentinelOne to monitor for DOM-based script injection patterns on WordPress installations
• Set up alerts for any contributor-level users making bulk edits to pages containing shortcodes
• Implement Content Security Policy (CSP) headers to detect and report XSS attempts

How to Mitigate CVE-2026-0550

Immediate Actions Required

• Update the myCred plugin to a version newer than 2.9.7.3 that includes the security patch
• Audit all existing content using the mycred_load_coupon shortcode for malicious payloads
• Review contributor and author user accounts for any suspicious activity or unauthorized changes
• Temporarily disable the myCred coupon shortcode functionality if immediate patching is not possible

Patch Information

A security patch addressing this vulnerability has been released by the myCred plugin developers. The fix implements proper input sanitization and output escaping for shortcode attributes. The patch can be reviewed in the WordPress Plugin Change Log. Additional vulnerability details are available in the Wordfence Vulnerability Report.

Workarounds

• Restrict contributor-level access to only trusted users until the patch is applied
• Implement server-side content filtering to strip potentially malicious shortcode attributes
• Use a WordPress security plugin with XSS filtering capabilities to sanitize shortcode output
• Deploy Content Security Policy headers to mitigate the impact of any successful XSS injection

# Temporarily disable the myCred coupon shortcode functionality
# Add to your theme's functions.php or a custom plugin
remove_shortcode('mycred_load_coupon');

# Or implement a sanitizing wrapper
# function sanitized_mycred_coupon($atts) {
#     $atts = array_map('esc_attr', (array)$atts);
#     return mycred_load_coupon_shortcode($atts);
# }
# add_shortcode('mycred_load_coupon', 'sanitized_mycred_coupon');