Is Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program safe?

Every recorded flaw

• Oct 22, 2026myCred: Authorization Bypass Through User-Controlled KeyCVE-2026-114698 · affects up to 4.0.0-beta.1 · reported by PatchstackMedium 5.4
• Sep 9, 2026Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred: Stored Cross-Site ScriptingCVE-2026-17149 · affects up to 3.2.4 · reported by WordfenceMedium 6.4
• Aug 21, 2026myCred: Does not verify that the receiver of an incoming payment gateway notification matches the site's configured merchant accountCVE-2026-15150 · fixed in 3.2.5 · reported by WPScanMedium 5.3
• Jul 13, 2026myCred: Missing AuthorizationCVE-2026-61968 · affects up to 3.1.2 · reported by PatchstackMedium 5.4
• Jun 17, 2026Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred: Stored Cross-Site ScriptingCVE-2026-8607 · affects up to 3.1 · reported by WordfenceMedium 6.4
• Jun 15, 2026Subscriber Broken Access Control in myCred <= 3.0.3 versions.CVE-2026-40794 · affects up to 3.0.3 · reported by PatchstackMedium 6.5
• Jun 1, 2026myCred: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-42676 · affects up to 3.0.4 · reported by PatchstackMedium 6.5
• Feb 19, 2026myCred: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27440 · affects up to 2.9.7.6 · reported by PatchstackMedium 6.5
• Feb 14, 2026myCred: Stored Cross-Site ScriptingCVE-2026-0550 · affects up to 2.9.7.3 · reported by WordfenceMedium 6.4
• Feb 3, 2026myCred: Missing AuthorizationCVE-2026-24951 · affects up to 2.9.7.3 · reported by PatchstackMedium 4.3
• Dec 19, 2025myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program: Missing AuthorizationCVE-2025-12361 · affects up to 2.9.7.1 · reported by WordfenceMedium 4.3
• Dec 13, 2025myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program: Missing AuthorizationCVE-2025-12362 · affects up to 2.9.7 · reported by WordfenceMedium 5.3
• Aug 14, 2025myCred: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54668 · affects up to 2.9.4.3 · reported by PatchstackMedium 6.5
• Aug 14, 2025myCred: Time-of-check Time-of-use (TOCTOU) Race ConditionCVE-2025-54667 · affects up to 2.9.4.3 · reported by PatchstackMedium 5.3
• Jun 17, 2025myCred: Missing AuthorizationCVE-2025-49872 · affects up to 2.9.4.2 · reported by PatchstackMedium 5.3
• Jun 17, 2025myCred: Missing AuthorizationCVE-2025-49857 · affects up to 2.9.4.2 · reported by PatchstackMedium 4.3
• Dec 6, 2024The myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce creditCVE-2024-11201 · affects up to 2.7.5.2 · reported by WordfenceMedium 6.4
• Nov 8, 2024The myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce creditCVE-2024-10187 · affects up to 2.7.4 · reported by WordfenceMedium 6.4
• Sep 25, 2024The myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce creditCVE-2024-8658 · affects up to 2.7.3 · reported by WordfenceMedium 5.3
• Aug 26, 2024myCred: Missing AuthorizationCVE-2024-43214 · affects up to 2.7.2 · reported by PatchstackMedium 5.3
• Aug 19, 2024myCred: Deserialization of Untrusted DataCVE-2024-43354 · affects up to 2.7.2 · reported by PatchstackCritical 9.8
• Aug 18, 2024myCred: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-43353 · affects up to 2.7.2 · reported by PatchstackMedium 6.5
• Apr 24, 2024myCred: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32711 · affects up to 2.6.3 · reported by PatchstackMedium 6.5
• Nov 30, 2023myCred – Points, Rewards, Gamification, Ranks, Badges & Loyalty: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-47853 · affects up to 2.6.1 · reported by PatchstackMedium 6.5
• Jul 17, 2023Cross-Site Request Forgery (CSRF) vulnerability in myCred plugin <= 2.5 versions.CVE-2023-35096 · affects up to 2.5.1 · reported by PatchstackMedium 6.5
• Apr 25, 2022myCred: Does not have authorisation and CSRF checks in its mycred-tools-import-export AJAX actionCVE-2022-1092 · fixed in 2.4.3.1 · reported by WPScanMedium 4.3
• Apr 25, 2022myCred: Does not have any authorisation and CSRF checks in the mycred-tools-import-export AJAX actionCVE-2022-0363 · fixed in 2.4.3.1 · reported by WPScanMedium 4.3
• Apr 25, 2022myCred: Does not have any authorisation in place in its mycred-tools-select-user AJAX actionCVE-2022-0287 · fixed in 2.4.4.1 · reported by WPScanMedium 4.3
• Jan 24, 2022myCred: Does not sanitise and escape the search query before outputting it back in the history dashboard pageCVE-2021-25015 · fixed in 2.4 · reported by WPScanMedium 6.1
• Nov 29, 2021myCred: Does not validate or escape the fields parameter before using it in a SQL statementCVE-2021-24755 · fixed in 2.3 · reported by WPScan1.4% oddsHigh 8.8
• Nov 29, 2021myCred: Does not sanitise and escape the user parameter before outputting it back in the Points Log admin dashboardCVE-2017-20008 · fixed in 1.7.8 · reported by WPScanMedium 6.1

Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.