Improper neutralization of script‑related HTML tags allows attackers to inject malicious JavaScript into pages rendered by the WordPress myCred plugin. This basic cross‑site scripting flaw can enable malicious code to run in users’ browsers that view the affected content.

The vulnerability impacts the WordPress myCred plugin for all installed instances from the earliest available release through version 4.0.2. Administrators using any of these versions should verify the installed plugin version and consider immediate remediation.

The CVSS base score of 4.3 indicates a moderate severity. The EPSS score is not available, so current exploitation probability is unknown. The flaw is not listed in CISA’s KEV catalog. Based on the description, it is inferred that attackers could exploit the vulnerability by submitting malicious script content through fields that the myCred plugin accepts. The lack of public exploitation data means the risk is primarily theoretical, but an attacker who can supply such content could create the exploit.