CVE-2026-0550: myCred WordPress Plugin XSS Vulnerability

CVE-2026-0550 Overview

CVE-2026-0550 is a Stored Cross-Site Scripting (XSS) vulnerability in the myCred plugin for WordPress. The flaw resides in the plugin's mycred_load_coupon shortcode and affects all versions up to and including 2.9.7.3. The plugin fails to properly sanitize input and escape output on user-supplied shortcode attributes. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript into pages. The injected scripts execute in the browser of any visitor who accesses the affected page. The issue is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Authenticated contributors can persistently inject JavaScript that executes in the context of every visitor, enabling session theft, administrator account takeover, and content defacement.

Affected Products

myCred plugin for WordPress, all versions up to and including 2.9.7.3
Specifically the mycred_load_coupon shortcode handler in addons/coupons/includes/mycred-coupon-shortcodes.php
WordPress sites permitting Contributor-level or higher user registrations

Discovery Timeline

2026-02-14 - CVE-2026-0550 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2026-0550

Vulnerability Analysis

The myCred plugin provides a loyalty and rewards system for WordPress, including a coupons add-on. The coupons feature exposes the mycred_load_coupon shortcode, which accepts user-supplied attributes when rendered on a post or page. The plugin processes those attributes and emits them into the rendered HTML without sufficient sanitization or escaping. An attacker with Contributor privileges can author a post containing the shortcode with malicious attribute values. When an editor, administrator, or site visitor views the post, the browser parses and executes the injected JavaScript.

Stored XSS in WordPress is particularly impactful because Contributor accounts are often granted via open registration or low-trust onboarding. Successful exploitation can hijack administrator sessions, plant backdoors via plugin or theme editors, exfiltrate post drafts, or redirect site traffic.

Root Cause

The root cause is missing input sanitization and missing output escaping on shortcode attributes processed by the mycred_load_coupon handler. WordPress provides helper functions such as sanitize_text_field() and esc_attr() / esc_html() for this purpose, but the vulnerable code path inserts attacker-controlled values directly into the HTML output. The vendor's fix is documented in the WordPress Plugin Changeset 3440785.

Attack Vector

The attack is network-based and requires authentication at the Contributor role or higher. The attacker creates or edits a post and embeds the mycred_load_coupon shortcode with crafted attribute values containing JavaScript payloads. After the post is published or previewed, any user who loads the page triggers script execution in their browser session. No user interaction beyond visiting the page is required. Refer to the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-0550

Indicators of Compromise

Posts or pages containing [mycred_load_coupon] shortcodes with unusual attribute values containing HTML event handlers (onerror, onload, onclick) or <script> fragments
New or recently active Contributor accounts authoring content that includes coupon shortcodes
Outbound browser requests from administrator sessions to unfamiliar domains shortly after visiting site content
Unexpected modifications to WordPress users, options, or plugin files following administrator page views

Detection Strategies

Scan the wp_posts table for shortcode patterns matching mycred_load_coupon and inspect attributes for script content or HTML event handlers
Review web server access logs for requests to pages containing the shortcode, correlated with admin-area activity
Monitor the WordPress audit trail for Contributor-role post submissions and edits to existing published content
Inspect Content Security Policy (CSP) violation reports for inline script execution on plugin-rendered pages

Monitoring Recommendations

Enable WordPress activity logging plugins to track post creation, editing, and user role changes
Alert on creation of new administrator accounts or modifications to existing privileged accounts
Monitor for plugin and theme file edits performed via the WordPress dashboard
Track installed myCred plugin versions across managed WordPress sites and flag versions at or below 2.9.7.3

How to Mitigate CVE-2026-0550

Immediate Actions Required

Update the myCred plugin to a version higher than 2.9.7.3 that includes the fix from changeset 3440785
Audit all existing posts and pages for mycred_load_coupon shortcode usage and remove any unexpected payloads
Review Contributor and Author accounts, removing or downgrading accounts that are no longer required
Force a password reset for administrators who may have viewed attacker-controlled content prior to patching

Patch Information

The vendor addressed the vulnerability in the myCred plugin source tree under changeset 3440785. The fix applies proper sanitization and escaping to shortcode attributes in mycred-coupon-shortcodes.php. Administrators should upgrade to the latest myCred release available through the WordPress plugin repository.

Workarounds

Disable the myCred coupons add-on until the plugin is updated
Restrict Contributor and Author roles via a capability management plugin to prevent use of the affected shortcode
Deploy a Web Application Firewall (WAF) rule that blocks mycred_load_coupon attribute values containing <script, javascript:, or HTML event handler patterns
Enforce a strict Content Security Policy that disallows inline script execution on public pages

bash

# Identify posts containing the vulnerable shortcode for review
wp db query "SELECT ID, post_title, post_status FROM wp_posts \
  WHERE post_content LIKE '%mycred_load_coupon%' \
  AND post_status IN ('publish','draft','pending');"

# Update the plugin via WP-CLI once a fixed release is available
wp plugin update mycred