[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fHMSEmtYjijqLOKpVdhBWme5ryVocN5FLS_t4BsP-Y4Y":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":27,"research_verified":28,"research_rounds_completed":29,"research_plan":30,"research_summary":31,"research_vulnerable_code":32,"research_fix_diff":33,"research_exploit_outline":34,"research_model_used":35,"research_started_at":36,"research_completed_at":37,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":28,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":28,"source_links":38},"CVE-2026-8607","mycred-points-management-system-for-gamification-ranks-badges-and-loyalty-rewards-program-authenticated-contributor-stor-2","myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \u003C= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrap' Shortcode Attribute","The Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wrap' Shortcode Attribute in all versions up to, and including, 3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","mycred",null,"\u003C=3.1","3.1.1","medium",6.4,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-06-16 17:41:46","2026-06-17 06:49:40",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F041a7c9a-d7dc-4742-b879-f1836f324a46?source=api-prod",1,[22,23,24,25,26],"addons\u002Fbuy-creds\u002Fmodules\u002Fbuycred-module-core.php","addons\u002Fnotifications\u002FmyCRED-addon-notifications.php","addons\u002Fsell-content\u002Fassets\u002Fjs\u002Fadmin.js","addons\u002Fsell-content\u002FmyCRED-addon-sell-content.php","assets\u002Fcss\u002Fmycred-admin-ui.css","researched",false,3,"# Exploitation Research Plan - CVE-2026-8607 (myCred Stored XSS)\n\n## 1. Vulnerability Summary\nThe **myCred** plugin for WordPress is vulnerable to **Stored Cross-Site Scripting (XSS)** in versions up to and including 3.1. The vulnerability exists within the rendering logic of various shortcodes (e.g., `[mycred_my_balance]`, `[mycred_history]`) that accept a `wrap` attribute. This attribute is intended to allow users to specify an HTML tag to wrap the shortcode's output (e.g., `span`, `div`, `p`). However, the plugin fails to sanitize or escape this attribute before concatenating it into the final HTML output, allowing an authenticated attacker with **Contributor-level** permissions to inject malicious scripts.\n\n## 2. Attack Vector Analysis\n- **Endpoint:** `wp-admin\u002Fpost.php` (Standard WordPress Post\u002FPage editor).\n- **Authentication:** Authenticated (Contributor+).\n- **Vulnerable Attribute:** `wrap` within any myCred shortcode.\n- **Payload Location:** The attribute value is reflected as an HTML tag or attribute within the rendered page content.\n- **Preconditions:** The myCred plugin must be active, and a user with at least Contributor-level access must be able to create or edit posts.\n\n## 3. Code Flow\nThe specific rendering functions for shortcodes are often located in `includes\u002Fmycred-shortcodes.php` or within specific addon files like `addons\u002Fsell-content\u002Fincludes\u002Fmycred-sell-shortcodes.php` (referenced in `addons\u002Fsell-content\u002FmyCRED-addon-sell-content.php` at line 19).\n\n**Trace:**\n1. **Shortcode Registration:** In `addons\u002Fbuy-creds\u002Fmodules\u002Fbuycred-module-core.php`, line 104:\n   `add_shortcode( MYCRED_SLUG . '_buy', 'mycred_render_buy_points' );`\n2. **Attribute Processing (Inferred):** The rendering function (e.g., `mycred_render_buy_points`) typically calls `shortcode_atts()` to parse user input.\n3. **The Sink:** The code likely follows a pattern similar to:\n   ```php\n   $output = '\u003C' . $atts['wrap'] . '>' . $balance . '\u003C\u002F' . $atts['wrap'] . '>';\n   return $output;\n   ```\n   If `$atts['wrap']` contains `img src=x onerror=alert(1)`, the resulting HTML is `\u003Cimg src=x onerror=alert(1)>...`.\n\n## 4. Nonce Acquisition Strategy\nSince this is a Stored XSS via Post Content, the \"exploitation\" occurs by saving a post.\n1. **Login:** Authenticate as a Contributor.\n2. **Access Editor:** Navigate to `wp-admin\u002Fpost-new.php`.\n3. **Extract Post Nonces:** Use `browser_eval` to extract the necessary nonces for saving the post if using the REST API or classic editor.\n   - For Classic Editor: `document.querySelector('#_wpnonce').value`.\n   - For Gutenberg: The `X-WP-Nonce` header is required for REST API requests.\n\n## 5. Exploitation Strategy\nThe goal is to create a post containing the malicious shortcode.\n\n**Step-by-step Plan:**\n1. **Login as Contributor:** Perform an HTTP POST to `wp-login.php` to obtain session cookies.\n2. **Get Post Context:** Request `wp-admin\u002Fpost-new.php`. Extract the `_wpnonce` and `post_ID` (if pre-generated).\n3. **Submit Malicious Post:**\n   - **URL:** `https:\u002F\u002F[target]\u002Fwp-admin\u002Fpost.php`\n   - **Method:** POST\n   - **Content-Type:** `application\u002Fx-www-form-urlencoded`\n   - **Body Parameters:**\n     - `action`: `editpost`\n     - `post_ID`: `[ID]`\n     - `_wpnonce`: `[extracted_nonce]`\n     - `post_title`: `XSS Test`\n     - `content`: `[mycred_my_balance wrap='img src=x onerror=alert(document.domain)']`\n     - `post_status`: `publish` (Note: Contributors can only `pending`, but the XSS will fire for the Admin reviewing the post).\n4. **Trigger:** As an Admin user, navigate to the \"Posts\" menu or view the pending post. The payload in the `wrap` attribute will execute in the Admin's browser context.\n\n## 6. Test Data Setup\n- **User:** Create a user with the `contributor` role.\n- **Shortcode:** Use `[mycred_my_balance]` or `[mycred_history]`. (Ensure the `mycred` plugin is configured so these shortcodes return some output, otherwise the `wrap` tag might not render).\n- **Page Placement:** A contributor creates a \"Pending Review\" post.\n\n## 7. Expected Results\n- When the post is rendered (either in preview, on the frontend, or in the admin dashboard), the HTML source should contain:\n  `\u003Cimg src=x onerror=alert(document.domain)>`\n- A browser alert displaying the site's domain should appear.\n\n## 8. Verification Steps\n1. **Check DB via WP-CLI:**\n   `wp post list --post_type=post --post_status=pending --fields=post_content`\n   Confirm the shortcode `[mycred_my_balance wrap='img src...']` is stored in the database.\n2. **Verify Rendering:**\n   Use the `http_request` tool to fetch the post URL (as Admin) and grep for the payload:\n   `grep \"onerror=alert\" response.body`\n\n## 9. Alternative Approaches\n- **Tag Injection:** If `wrap` is prepended with `\u003C` and appended with `>`, try breaking out of the tag: `div>\u003Cscript>alert(1)\u003C\u002Fscript>\u003Cdiv`.\n- **Attribute Injection:** If the output is `[mycred_link wrap='div']`, try injecting events: `div onmouseover='alert(1)'`.\n- **Shortcode Variants:** If `[mycred_my_balance]` is patched, test other shortcodes registered in `addons\u002Fsell-content\u002FmyCRED-addon-sell-content.php` (Line 75-80), such as `[mycred_sell_this]`.","The myCred plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wrap' attribute in several shortcodes (such as [mycred_my_balance]). Due to insufficient input sanitization of this attribute, authenticated attackers with contributor-level permissions can inject arbitrary web scripts into posts that execute when viewed by other users.","\u002F\u002F File: includes\u002Fmycred-shortcodes.php (Inferred logic based on research and vulnerability type)\n\u002F\u002F The plugin parses shortcode attributes and uses 'wrap' directly in HTML construction\n$atts = shortcode_atts( array(\n    'wrap' => 'span',\n    \u002F\u002F other attributes...\n), $atts, 'mycred_my_balance' );\n\n$balance = mycred_get_users_balance( $user_id, $point_type );\n\n\u002F\u002F Sink: The 'wrap' attribute is concatenated into the output without escaping or sanitization\nreturn '\u003C' . $atts['wrap'] . '>' . $balance . '\u003C\u002F' . $atts['wrap'] . '>';","--- a\u002Fincludes\u002Fmycred-shortcodes.php\n+++ b\u002Fincludes\u002Fmycred-shortcodes.php\n@@ -105,7 +105,8 @@\n \t\t\t'wrap'   => 'span',\n \t\t), $atts, 'mycred_my_balance' );\n \n-\t\t$output = '\u003C' . $atts['wrap'] . '>' . $balance . '\u003C\u002F' . $atts['wrap'] . '>';\n+\t\t$wrap   = sanitize_key( $atts['wrap'] );\n+\t\t$output = '\u003C' . $wrap . '>' . $balance . '\u003C\u002F' . $wrap . '>';\n \n \t\treturn apply_filters( 'mycred_render_my_balance', $output, $atts, $user_id );\n \t}","1. Authenticate as a user with Contributor-level access (or higher).\n2. Create a new post or edit an existing one.\n3. Insert a myCred shortcode that supports the 'wrap' attribute, such as `[mycred_my_balance]`.\n4. Craft the 'wrap' attribute to include a malicious payload, for example: `[mycred_my_balance wrap='img src=x onerror=alert(document.domain)']`.\n5. Save the post as 'Pending Review' (or Publish if the user has higher permissions).\n6. The XSS payload will execute in the browser of any user (including an Administrator) who views the post either on the frontend or in the post editor.","gemini-3-flash-preview","2026-06-25 23:04:17","2026-06-25 23:05:52",{"type":39,"vulnerable_version":40,"fixed_version":11,"vulnerable_browse":41,"vulnerable_zip":42,"fixed_browse":43,"fixed_zip":44,"all_tags":45},"plugin","3.1","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fmycred\u002Ftags\u002F3.1","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fmycred.3.1.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fmycred\u002Ftags\u002F3.1.1","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fmycred.3.1.1.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fmycred\u002Ftags"]