CVE-2026-17149 Overview
CVE-2026-17149 is a Stored Cross-Site Scripting (XSS) vulnerability in the myCred plugin for WordPress, a points management system used for gamification, ranks, badges, and loyalty rewards programs. The flaw affects all plugin versions up to and including 3.2.4. It stems from insufficient input sanitization and output escaping on the wrapper attribute of a shortcode delivered by the plugin's Sell Content addon. Authenticated users with contributor-level access or higher can inject arbitrary JavaScript into pages. The payload executes in the browser of any visitor who loads the affected page. The vulnerability is classified under CWE-79.
Critical Impact
Contributor-level accounts can persist JavaScript in published content, enabling session theft, forced administrative actions, and defacement against site visitors and administrators.
Affected Products
- myCred plugin for WordPress — all versions up to and including 3.2.4
- Impacted component: addons/sell-content/includes/mycred-sell-shortcodes.php
- Impacted addon: myCRED Sell Content Addon (myCRED-addon-sell-content.php)
Discovery Timeline
- 2026-09-09 - CVE-2026-17149 published to NVD
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-17149
Vulnerability Analysis
The myCred Sell Content addon registers a shortcode that accepts a wrapper attribute. The shortcode handler renders this attribute into the page HTML without applying adequate sanitization or output escaping. An authenticated user with contributor privileges can embed the shortcode in a post or page and supply a wrapper value containing HTML tags and JavaScript. Because WordPress executes shortcodes at render time, the injected markup becomes part of the served DOM. Any visitor loading the page executes the attacker-supplied script within the site's origin. The Wordfence advisory and the vendor's plugin source tree confirm the sink locations in mycred-sell-shortcodes.php at lines 152 and 163. The scope-changed impact reflects that scripts executing in an administrator's browser can act on adjacent WordPress components.
Root Cause
The root cause is missing input sanitization and output escaping on a user-controlled shortcode attribute. The plugin does not pass the wrapper parameter through WordPress helpers such as esc_attr(), wp_kses(), or sanitize_text_field() before echoing it into HTML. Contributor-level roles retain shortcode authoring privileges by default, which lowers the attacker skill and access requirement.
Attack Vector
An authenticated attacker submits a post or page containing the vulnerable myCred Sell Content shortcode with a malicious wrapper attribute. After the content is published or previewed, any user who loads the page triggers the payload. Exploitation is network-reachable and requires no user interaction beyond visiting the injected page. Attackers can target editors and administrators to escalate impact by piggybacking on their authenticated sessions.
No verified proof-of-concept code is available in the enriched dataset. Refer to the Wordfence Vulnerability Report and the myCRED Changeset Overview for authoritative technical details.
Detection Methods for CVE-2026-17149
Indicators of Compromise
- Post or page content containing myCred Sell Content shortcodes where the wrapper attribute includes <script>, on*= event handlers, javascript: URIs, or encoded HTML entities.
- Newly created or modified posts by contributor-role accounts that embed myCred shortcodes without prior authoring history.
- Outbound requests from visitor browsers to unfamiliar domains immediately after rendering a myCred-enabled page.
Detection Strategies
- Query the wp_posts table for shortcode patterns matching the vulnerable attribute, for example post_content LIKE '%wrapper=%<%'.
- Inspect rendered HTML of pages using myCred shortcodes for injected <script> blocks or inline event handlers not present in templates.
- Correlate WordPress audit logs for contributor accounts publishing content that references the Sell Content addon.
Monitoring Recommendations
- Enable a Web Application Firewall (WAF) ruleset that flags shortcode attributes containing HTML control characters.
- Alert on privilege escalations or role changes that follow contributor-authored content publication.
- Monitor administrative session activity for anomalous XHR calls to /wp-admin/admin-ajax.php originating from content pages.
How to Mitigate CVE-2026-17149
Immediate Actions Required
- Upgrade the myCred plugin to a release later than 3.2.4 that includes the fix referenced in the vendor changeset.
- Audit contributor-level and above accounts, and revoke unused credentials.
- Review recently published posts and pages for embedded myCred shortcodes containing HTML in the wrapper attribute.
Patch Information
The vendor addressed the issue in a plugin update tracked by the myCRED Changeset Overview. Site operators should update through the WordPress plugin management interface or by deploying the patched release from the official plugin repository. Confirm the running version is greater than 3.2.4 after upgrade.
Workarounds
- Temporarily deactivate the myCred Sell Content addon until the plugin is upgraded.
- Restrict contributor and author roles from using the affected shortcode by applying a custom remove_shortcode() filter for the Sell Content shortcode.
- Deploy a WAF rule that blocks POST requests to /wp-admin/post.php where shortcode attributes contain angle brackets or event-handler substrings.
# Configuration example: verify the installed myCred plugin version via WP-CLI
wp plugin get mycred --field=version
# Update the plugin to the patched release
wp plugin update mycred
# Optional: disable the vulnerable addon until patching is confirmed
wp option patch delete mycred_pref_core active_addons sell-content
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
