Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 27% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Refined from the date this plugin crossed into its current band.

No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price.

1. ★★★★★ liparikimberly

   3mo ago

   Genuinely impressed by how much myCred offers right out of the box — even on the free plan. The customization options are extensive, and setting up a gamification system feels intuitive rather than overwhelming. It’s the kind of plugin that grows with you; start simple, then layer in complexity as you need it. The fact that something this powerful is also this easy to use says a lot about how thoughtfully it’s been built. Moving to premium without hesitation. Well done to the team!

   Read on wp.org ↗
2. ★★★★★ taylorlorenz

   5mo ago

   WordPress, myCed plugin, this is an example of customer review, Very powerful gamification tool. With all the addons it gives planty hooks, works with number of external plugins enriching also subscription products or online store. Great support – developer fixed all the problems with installation, configuration and personalization of the plugin. write a good positive review of myCred plugin.

   Read on wp.org ↗
3. ★★★★★ usefulmike

   8mo ago

   3 stars for having nice out of the box features but the “Link” and “Watch Video” widgets in Elementor don’t delete when you delete them. In fact if you delete the containers they’re in they duplicate. I have checked to see if they could be removed from the Text editor out of Elementor but it doesn’t even show up. I have had to wipe 2 pages that had either widgets. I tried to save the blocks as templates but the Link widget was STILL present. Thankfully I was able to delete the template to remove the Link widget but it cost me half of my days work. Please look into this or I’ll have to find a different gamification solution. Thanks

   Read on wp.org ↗
4. ★★★★★ markabah3

   9mo ago

   Very efficient

   Read on wp.org ↗
5. ★★★★★ dirtyharry99

   9mo ago

   The support is fantastic. Thanks Talha Bukhari

   Read on wp.org ↗
6. ★★★★★ piratedivebar

   9mo ago

   The support was prompt! The problem was in another companies plugin not theirs. Talha Bukhari went above and beyond and fixed their plugin so the issue could be resolved. You can trust their support!

   Read on wp.org ↗
7. ★★★★★ beachcalsix

   10mo ago

   We have a startup that experiences many conflicts and really value great support and help. Mycred support has been great in helping us solve errors that happen.

   Read on wp.org ↗
8. ★★★★★ mastersegarra

   10mo ago

   The support for this plug in is great. I’m a bit of a newbie with wordpress and mycred support has helped me tremendously. Great plug in & Great support!

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 3.2.3 TWEAK – Rollback to v3.2.1 3.2.3
2. — Version 3.2.2 FIX – Added PayPal merchant verification in BuyCred Addon. 3.2.2
3. — Version 3.2.1 FIX – AI Assistant menu redirection issue. 3.2.1
4. — Version 3.2.0 NEW – Merged the built-in Add-ons and Toolkit pages into a single unified Add-ons page. 3.2.0
5. — Version 3.1.2 TWEAK – Loyalty widget UI improvements. 3.1.2
6. — Version 3.1.1 TWEAK – Vulnerability fixes. TWEAK – Code improvement. TWEAK – Added PHP 8.5 support. FIX – Badges UI and Buycred purchase log UI issue fixed. 3.1.1

32 disclosed vulnerabilities on record for this plugin, all fixed in the current version. Sites on older versions stay exposed until they update.

1. Medium · 5.3 Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred < 3.2.5 - Unauthenticated Payment Bypass ↗
   2026-08-24 CVE-2026-15150 Insufficient Verification of Data Authenticity Affects < 3.2.5 Patched in 3.2.5
2. Medium · 4.3 myCred <= 3.1.2 - Missing Authorization ↗
   2026-07-29 CVE-2026-61968 Missing Authorization Affects <= 3.1.2 Patched in 3.2.0
3. Medium · 6.4 myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrap' Shortcode Attribute ↗
   2026-06-16 CVE-2026-8607 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 3.1 Patched in 3.1.1
4. Medium · 6.4 Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred <= 3.0.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting ↗
   2026-05-15 CVE-2026-42676 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 3.0.4 Patched in 3.0.5
5. Medium · 4.3 Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred <= 3.0.3 - Missing Authorization ↗
   2026-04-24 CVE-2026-40794 Missing Authorization Affects <= 3.0.3 Patched in 3.0.4
6. Medium · 6.4 myCred <= 2.9.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mycred_load_coupon' Shortcode ↗
   2026-02-13 CVE-2026-0550 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.9.7.3 Patched in 2.9.7.4
7. Medium · 4.3 myCred <= 2.9.7.3 - Missing Authorization ↗
   2026-02-06 CVE-2026-24951 Missing Authorization Affects <= 2.9.7.3 Patched in 2.9.7.4
8. Medium · 4.3 myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program <= 2.9.7.1 - Missing Authorization to Sensitive Information Exposure ↗
   2025-12-18 CVE-2025-12361 Missing Authorization Affects <= 2.9.7.1 Patched in 2.9.7.2
9. Medium · 5.3 myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program <= 2.9.7 - Missing Authorization to Unauthenticated Withdrawal Request Approval ↗
   2025-12-12 CVE-2025-12362 Missing Authorization Affects <= 2.9.7 Patched in 2.9.7.1
10. Medium · 6.4 myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program. <= 2.9.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2025-11-08 CVE-2026-27440 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.9.7.6 Patched in 3.0
11. Medium · 6.4 myCred <= 2.9.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2025-07-30 CVE-2025-54668 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.9.4.3 Patched in 2.9.4.4
12. Medium · 4.3 myCred <= 2.9.4.3 - Authenticated (Subscriber+) Race Condition ↗
    2025-07-30 CVE-2025-54667 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') Affects <= 2.9.4.3 Patched in 2.9.4.4
13. Medium · 5.3 myCred <= 2.9.4.2 - Missing Authorization ↗
    2025-06-12 CVE-2025-49872 Missing Authorization Affects <= 2.9.4.2 Patched in 2.9.4.3
14. Medium · 4.3 myCred <= 2.9.4.2 - Missing Authorization ↗
    2025-06-12 CVE-2025-49857 Missing Authorization Affects <= 2.9.4.2 Patched in 2.9.4.3
15. Medium · 6.4 myCred – Loyalty Points and Rewards plugin <= 2.7.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via mycred_send Shortcode ↗
    2024-12-05 CVE-2024-11201 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.7.5.2 Patched in 2.7.6
16. Medium · 6.4 myCred <= 2.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via mycred_link Shortcode ↗
    2024-11-07 CVE-2024-10187 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.7.4 Patched in 2.7.5
17. Medium · 5.3 myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits for Gamification <= 2.7.3 - Missing Authorization to Unauthenticated Database Upgrade ↗
    2024-09-24 CVE-2024-8658 Missing Authorization Affects <= 2.7.3 Patched in 2.7.4
18. High · 8.1 myCred <= 2.7.2 - Unauthenticated PHP Object Injection ↗
    2024-08-16 CVE-2024-43354 Deserialization of Untrusted Data Affects <= 2.7.2 Patched in 2.7.3
19. Medium · 6.4 myCred <= 2.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2024-08-16 CVE-2024-43353 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.7.2 Patched in 2.7.3
20. Medium · 5.3 myCred <= 2.7.2 - Unauthenticated Information Exposure ↗
    2024-08-09 CVE-2024-43214 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 2.7.2 Patched in 2.7.3
21. Medium · 5.4 myCred – Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin <= 2.6.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting ↗
    2024-04-22 CVE-2024-32711 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.6.3 Patched in 2.6.4
22. Medium · 6.4 myCred <= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2023-11-20 CVE-2023-47853 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.6.1 Patched in 2.6.2
23. Medium · 6.1 Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get ↗
    2023-07-18 CVE-2023-33999 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.5.2 Patched in 2.5.3
24. Medium · 4.3 myCred <= 2.5 - Cross-Site Request Forgery ↗
    2023-06-14 CVE-2023-35096 Cross-Site Request Forgery (CSRF) Affects < 2.5.1 Patched in 2.5.1
25. Medium · 6.1 myCred – Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin <= 2.4.6.1 - Cross-Site Scripting ↗
    2022-06-16 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.4.6.1 Patched in 2.4.7
26. Medium · 4.3 myCred – Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin <= 2.4.3 - Missing Authorization ↗
    2022-04-04 CVE-2022-0287 Missing Authorization Affects < 2.4.3.1 Patched in 2.4.3.1
27. Medium · 4.3 myCred – Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin <= 2.4.3 - Missing Authorization ↗
    2022-03-29 CVE-2022-1092 Missing Authorization Affects < 2.4.4 Patched in 2.4.4
28. Medium · 6.5 myCred – Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin <= 2.4.3 - Missing Authorization ↗
    2022-03-29 CVE-2022-0363 Missing Authorization Affects < 2.4.4 Patched in 2.4.4
29. Medium · 6.3 Freemius SDK <= 2.4.2 - Missing Authorization Checks ↗
    2022-03-04 CVE-2022-4974 Missing Authorization Affects < 2.4.3.1 Patched in 2.4.3.1
30. Medium · 6.1 myCred – Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin <= 2.3.2 - Reflected Cross-Site Scripting ↗
    2021-12-27 CVE-2021-25015 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.3.2 Patched in 2.4
31. High · 8.8 myCred – Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin <= 2.2 - Subscriber+ SQL Injection ↗
    2021-11-01 CVE-2021-24755 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 2.2 Patched in 2.3
32. Medium · 6.1 myCred Plugin <= 1.7.7 - Reflected Cross-Site Scripting ↗
    2017-04-20 CVE-2017-20008 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 1.7.8 Patched in 1.7.8

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0

Translated into 123 languages, 0 at 90% or more

Plus 99 more locales with partial translations.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2023-08-02 20K+ → 10K+ down

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• 8 800Website Loyalty Rewards for WooCommerce — installs · 3.6★ · 4 shared tags B
• Qero – Loyalty Program for your store — installs · 3.6★ · 4 shared tags D
• Australcode Points and Rewards for WooCommerce — installs · 3.6★ · 4 shared tags B
• Loyalty Points Rewards and Referral for WooCommerce – WPLoyalty 3K+ installs · 4.9★ · 3 shared tags A
• MyRewards 2K+ installs · 4.6★ · 3 shared tags A
• Easy Loyalty Points and Rewards for WooCommerce 300+ installs · 4.2★ · 3 shared tags D

Embed this report card

Drop a live Pulse card for Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred into a readme, a review or a deck. It updates itself.

Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred: 10K+ active installs, 4.6★ (470 reviews). Plugin Pulse (WP Mayor), as of 2026-08-29. https://plugins.wpmayor.com/plugin/mycred