The vulnerability allows a contributor or higher‑level authenticated user to inject arbitrary JavaScript through the myCred plugin’s stored shortcode, leading to script execution whenever any user views a page containing the injected content. As a result, attackers could hijack sessions, deface content, or exfiltrate data, representing a classic example of unchecked input leading to client‑side code execution (CWE‑79).

WordPress sites running the myCred Points Management System plug‑in released by saadiqbal, in all versions up to and including 2.9.7.3. No specific version segmentation is provided beyond that cutoff, so every installation of these releases is potentially vulnerable.

The CVSS score of 6.4 positions the weakness in the medium range, while the EPSS value of less than 1 % indicates a very low probability of current exploitation. It is not listed in CISA’s KEV catalog. The attack vector requires an authenticated user with contributor roles or higher, so the attack surface is limited to site members who necessarily exist on every WordPress site using the plugin. The vulnerability could be leveraged to deliver persistent malicious scripts to all site visitors, yet the necessity of prior access and the low public exploitation likelihood combine to moderate overall risk.