Improper neutralization of user input in the myCred WordPress plugin allows stored cross‑site scripting. Infected input is rendered unsanitized in web pages, giving an attacker the ability to inject arbitrary JavaScript that executes in the browser context of any visitor. Based on the description, it is inferred that the vulnerability is a classic input validation weakness categorized as CWE‑79, enabling client‑side code execution.

The vulnerability affects all installations of the myCred plugin from version n/a through 2.9.7.6 for the Saad Iqbal myCred WordPress plugin. Any WordPress site running these versions is at risk, as the plugin’s handling of stored content that is later displayed to users creates the opportunity for exploitation.

The base CVSS score of 6.5 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation at present. The vulnerability has not yet been catalogued in CISA’s KEV list. The likely attack vector is through web‑based input fields that save data for later rendering, meaning an attacker only needs access to a front‑end interface or an administrative input area that is not properly sanitized. Given the stored nature of the flaw, any user who visits the affected page will execute the injected script.