myCRED < 1.7.8 - Reflected Cross-Site Scripting
CVE-2017-20008

6.1MEDIUM

Key Information:

Vendor

Wordpress
Status
Mycred – Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin
Vendor
CVE Published:
29 November 2021

What is CVE-2017-20008?

The myCred WordPress plugin before 1.7.8 does not sanitise and escape the user parameter before outputting it back in the Points Log admin dashboard, leading to a Reflected Cross-Site Scripting

Affected Version(s)

myCred – Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin 1.7.8

References

https://wpscan.com/vulnerability/3175c56d-27bb-4bf1-b6ba-...
x_refsource_MISC
https://plugins.trac.wordpress.org/changeset/1639363/mycred
x_refsource_CONFIRM

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jeremie Amsellem
.