myCred vulnerabilities

🔔 Create alert RSS

Published CVEs affecting myCred products: 4 record(s), with severity, exploitation and fixes.

myCred 2 License Manager for WooCommerce 1 Bookify 1

Exploited only (KEV) →

CVE-2026-56013 Medium · 6.5 CWE-639 Jun 25, 2026

WordPress License Manager for WooCommerce plugin <= 3.0.15 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References (IDOR) in License Manager for WooCommerce <= 3.0.15 versions.

CVE-2026-40794 Medium · 6.5 CWE-862 Jun 15, 2026

WordPress myCred plugin <= 3.0.3 - Broken Access Control vulnerability

Subscriber Broken Access Control in myCred <= 3.0.3 versions.

CVE-2025-69332 Medium · 6.5 CWE-862 Jun 15, 2026

WordPress Bookify plugin <= 1.1.1 - Broken Access Control vulnerability

Subscriber Broken Access Control in Bookify <= 1.1.1 versions.

CVE-2026-42676 Medium · 6.5 CWE-79 Jun 1, 2026

WordPress myCred plugin <= 3.0.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in myCred allows Stored XSS. This issue affects myCred: from n/a through 3.0.4.