CVE-2017-20008

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The myCred WordPress plugin before 1.7.8 does not sanitise and escape the user parameter before outputting it back in the Points Log admin dashboard, leading to a Reflected Cross-Site Scripting

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	myCred – Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin	>= 1.7.8, < 1.7.8

References

https://plugins.trac.wordpress.org/changeset/1639363/mycredRelease Notes, Third Party Advisory
https://wpscan.com/vulnerability/3175c56d-27bb-4bf1-b6ba-737541483d40Exploit, Third Party Advisory
https://plugins.trac.wordpress.org/changeset/1639363/mycredRelease Notes, Third Party Advisory
https://wpscan.com/vulnerability/3175c56d-27bb-4bf1-b6ba-737541483d40Exploit, Third Party Advisory

Timeline

Published: Nov 29, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-200115.5A vulnerability was found in WEKA INTEREST Security Scanner 1.8. It has been rated as problematic. This issue affects some unknown processin CVE-2017-200125.5A vulnerability classified as problematic has been found in WEKA INTEREST Security Scanner up to 1.8. Affected is Stresstest Scheme Handler CVE-2017-200135.5A vulnerability classified as problematic was found in WEKA INTEREST Security Scanner up to 1.8. Affected by this vulnerability is the Stres CVE-2017-200145.5A vulnerability, which was classified as problematic, has been found in WEKA INTEREST Security Scanner up to 1.8. Affected by this issue is CVE-2017-200155.5A vulnerability, which was classified as problematic, was found in WEKA INTEREST Security Scanner up to 1.8. This affects an unknown part of CVE-2017-200167.5A vulnerability has been found in WEKA INTEREST Security Scanner up to 1.8 and classified as problematic. This vulnerability affects unknown CVE-2017-200178.8A vulnerability, which was classified as critical, has been found in The Next Generation of Genealogy Sitebuilding up to 11.1.0. This issue CVE-2017-200187.8A vulnerability was found in XAMPP 7.1.1-0-VC14. It has been classified as problematic. Affected is an unknown function of the component Ins CVE-2017-200197.5A vulnerability classified as problematic was found in Solare Solar-Log 2.8.4-56/3.5.2-85. Affected by this vulnerability is an unknown func CVE-2017-200208.8A vulnerability, which was classified as problematic, has been found in Solare Solar-Log 2.8.4-56/3.5.2-85. Affected by this issue is some u CVE-2017-200219.8A vulnerability, which was classified as critical, was found in Solare Solar-Log 2.8.4-56/3.5.2-85. This affects an unknown part of the comp CVE-2017-200227.5A vulnerability has been found in Solare Solar-Log 2.8.4-56/3.5.2-85 and classified as problematic. This vulnerability affects unknown code.