CVE-2026-8607: WordPress myCred Plugin XSS Vulnerability

CVE-2026-8607 Overview

CVE-2026-8607 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the myCred plugin for WordPress, a points management system used for gamification, ranks, badges, and loyalty rewards programs. The flaw affects all versions up to and including 3.1 and stems from insufficient input sanitization and output escaping on the wrap attribute of the mycred_leaderboard shortcode. Authenticated attackers with contributor-level access or above can inject arbitrary JavaScript that executes when any user views the affected page.

Critical Impact
Authenticated contributors can store malicious scripts that execute in the browsers of site visitors and administrators, enabling session theft, privilege escalation through admin actions, and content manipulation.

Affected Products

myCred plugin for WordPress, versions up to and including 3.1
Vulnerable files: includes/classes/class.query-leaderboard.php and includes/shortcodes/mycred_leaderboard.php
Sites allowing contributor-level user registration are at elevated risk

Discovery Timeline

2026-06-17 - CVE-2026-8607 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-8607

Vulnerability Analysis

The vulnerability resides in how the myCred leaderboard shortcode processes the wrap attribute. When a contributor or higher-privileged user embeds the mycred_leaderboard shortcode in a post or page, the value supplied to wrap is rendered into the page output without proper escaping. Any HTML or JavaScript supplied through this attribute is stored in the post content and executed in the browser of every visitor who loads the page.

Because the payload persists in the database, the impact extends beyond the original injecting user. Administrators viewing the affected page in the WordPress backend or frontend can have their authenticated session abused for actions such as creating new admin accounts, modifying plugin settings, or exfiltrating cookies and tokens.

Root Cause

The root cause is missing input sanitization on shortcode attributes and missing output escaping when rendering the wrapping element. The leaderboard rendering logic in class.query-leaderboard.php and mycred_leaderboard.php concatenates the wrap attribute directly into HTML output. WordPress hardening functions such as esc_attr() or wp_kses() are not applied to the user-controlled value.

Attack Vector

An attacker first obtains a contributor account on a target WordPress site. The attacker then creates or edits a draft post containing the mycred_leaderboard shortcode with a crafted wrap attribute carrying a JavaScript payload. When the post is previewed, published, or reviewed by an editor or administrator, the script executes in their authenticated session. The scope-changed nature of the issue means the injected script runs in the security context of any user who renders the page.

No exploitation code is published for this issue at the time of writing. Refer to the Wordfence Vulnerability Analysis for additional technical context.

Detection Methods for CVE-2026-8607

Indicators of Compromise

Posts or pages containing mycred_leaderboard shortcodes with unusual wrap attribute values containing HTML tags, <script>, javascript:, or event handlers such as onerror= and onload=
Unexpected outbound requests from administrator browsers to attacker-controlled domains following page views
Creation of new administrator accounts or plugin/theme modifications shortly after a contributor publishes or updates content

Detection Strategies

Audit the wp_posts table for post_content entries matching the pattern mycred_leaderboard with wrap= containing HTML or script tokens
Review WordPress access logs for contributor-level accounts editing posts containing leaderboard shortcodes
Inspect browser Content Security Policy (CSP) violation reports for inline script execution on pages rendering myCred shortcodes

Monitoring Recommendations

Enable file integrity monitoring on the wp-content/plugins/mycred/ directory to detect tampering and confirm patch installation
Forward WordPress audit logs to a centralized SIEM and alert on contributor-to-admin privilege changes or new user creation
Monitor for unexpected administrative actions occurring within minutes of a contributor publishing or updating content

How to Mitigate CVE-2026-8607

Immediate Actions Required

Update the myCred plugin to a version newer than 3.1 that includes the fix from WordPress Changeset #3572451
Audit existing posts and pages for malicious mycred_leaderboard shortcodes and remove any suspicious wrap attribute payloads
Review the list of contributor and author accounts and disable or remove untrusted users
Rotate administrator session cookies and force password resets if injected content is found

Patch Information

The vendor addressed the issue in the changeset published at WordPress Changeset #3572451. The fix applies proper sanitization and escaping to shortcode attribute output. Site administrators should install the fixed release through the WordPress plugin updater or by replacing the plugin files manually.

Workarounds

Restrict the mycred_leaderboard shortcode to trusted roles by removing the shortcode registration or wrapping it with a capability check until the patched version is installed
Temporarily disable contributor-level registration and require editor approval for new content
Deploy a web application firewall (WAF) rule that blocks requests containing wrap= parameters with HTML or script tokens targeting WordPress post endpoints

bash

# Example: disable the vulnerable shortcode via mu-plugin until patch is applied
# wp-content/mu-plugins/disable-mycred-leaderboard.php
add_action('init', function () {
    remove_shortcode('mycred_leaderboard');
}, 100);