CVE-2026-14379
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The GamiPress – Gamification plugin to reward points, achievements, badges & ranks for WordPress is vulnerable to Stored Cross-Site Scripting via the 'video_id' parameter in all versions up to and including 7.9.4 due to insufficient input sanitization and output escaping. An authenticated attacker with subscriber-level access or above can inject arbitrary web scripts into pages that execute whenever a user visits the injected page.
Risk Assessment
Even a user with the lowest privileges (subscriber) can persistently inject malicious JavaScript into site pages, potentially leading to session theft, redirects, or administrator account takeover. Any WordPress site running the vulnerable plugin version is at risk.
Recommendation
Update the GamiPress plugin to a version newer than 7.9.4 as soon as a fix is available, and consider restricting subscriber account registration if not needed.
Other vulnerabilities in GamiPress – Gamification plugin to reward points, achievements, badges & ranks
Original NVD description (English source)
The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'video_id' parameter in all versions up to, and including, 7.9.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS