Improper sanitization of user input in the myCred WordPress plugin enables attackers to store malicious scripts directly in the database, which are then rendered when pages load. The primary effect is the ability to execute arbitrary client‑side code in the browsers of site visitors, potentially leading to session hijacking, credential theft, or defacement of content. The vulnerability is a classic stored XSS flaw (CWE-79).

The flaw exists in all releases of the myCred plugin up to and including version 3.0.4. Users running any older or the referenced versions on WordPress installations are affected until the plugin is updated to 3.0.5 or later.

The CVSS score of 6.5 indicates a medium‑to‑high risk if an attacker can inject scripts. No EPSS data is available, so the current exploitation likelihood is unknown, and the vulnerability is not listed in the CISA KEV catalog. Attackers must have access to a form or input that stores data through the plugin, a condition typically satisfied on publicly exposed sites. Should successful exploitation occur, the attacker can execute code in the context of any user visiting the affected page.