CVE-2017-20008

CVE-2017-20008: myCRED < 1.7.8 - Reflected Cross-Site Scripting

Vendor Unknown

Product myCred – Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin

Weakness CWE-79 · XSS

Published November 29, 2021

Last update August 5, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The myCred WordPress plugin before 1.7.8 does not sanitise and escape the user parameter before outputting it back in the Points Log admin dashboard, leading to a Reflected Cross-Site Scripting

Key dates

02Disclosure timeline

November 29, 2021 CVE published

August 5, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2017-20008 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2024-2187 Beaver Builder Addons by WPZOOM <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonials Widget CVE-2018-15400 Cisco Cloud Services Platform 2100 Cross-Site Scripting Vulnerability CVE-2025-13412 Campcodes Retro Basketball Shoes Online Store admin_running.php cross site scripting CVE-2019-25375 OPNsense 19.1 Reflected XSS via monit interface CVE-2025-31734 WordPress Simple Post Expiration plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability