PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-42676 myCred CVE debrief

A stored cross-site scripting (XSS) vulnerability exists in the myCred WordPress plugin, affecting versions up to and including 3.0.4. The weakness stems from improper neutralization of input during web page generation (CWE-79), allowing an attacker with low privileges to inject and persist malicious scripts that execute in the context of other users' browsers. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) yields a base score of 6.5 (Medium), reflecting network attackability, low attack complexity, required low privileges, user interaction, changed scope, and low impacts across confidentiality, integrity, and availability. The CVE was published and last modified on June 1, 2026. The vulnerability status in NVD is currently Deferred. No known exploitation in ransomware campaigns has been documented, and this CVE does not appear on the CISA KEV catalog.

Vendor
myCred
Product
Unknown
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-01
Original CVE updated
2026-07-22
Advisory published
2026-06-01
Advisory updated
2026-07-22

Who should care

WordPress site administrators running myCred plugin versions ≤3.0.4; security teams managing plugin inventories; developers maintaining custom integrations with myCred functionality.

Technical summary

The myCred WordPress plugin fails to properly sanitize user-supplied input before rendering it in web pages, resulting in a stored XSS condition (CWE-79). An authenticated attacker with low privileges can inject persistent JavaScript payloads that execute when other users view affected pages. The scope change (S:C) in the CVSS vector indicates the vulnerable component impacts resources beyond its own security context. Affected versions span from initial release through 3.0.4 inclusive.

Defensive priority

medium

Recommended defensive actions

  • Upgrade myCred to a version newer than 3.0.4 if a patched release is available from the vendor.
  • Apply principle of least privilege to WordPress user accounts, limiting access to the myCred plugin's administrative functions.
  • Implement Content Security Policy (CSP) headers and output encoding defenses as compensating controls for XSS risks in WordPress environments.
  • Monitor for unexpected script execution or unauthorized HTML injection within myCred-generated pages.
  • Review Patchstack advisory for any vendor-supplied mitigation guidance specific to this vulnerability.

Evidence notes

The vulnerability description and affected version range (through 3.0.4) are sourced from the official CVE record and NVD entry. The CVSS vector and score are derived from NVD metadata. The vendor attribution is marked low-confidence based on reference domain candidate evidence pointing to Patchstack; the vendor field requires review.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-42676 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-42676

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-42676 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-42676

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.