CVE-2026-16090
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
The GamiPress plugin for WordPress is vulnerable to stored XSS via the 'heading_size' shortcode attribute in 'gamipress_achievement'. Attackers with contributor-level access can inject arbitrary scripts that execute when a user visits the page.
Risk Assessment
The risk involves injection of malicious scripts, potentially leading to session theft, redirects, or site defacement.
Recommendation
Immediately update the GamiPress plugin to the latest version and apply proper input sanitization and output escaping.
Other vulnerabilities in GamiPress
See all- CVE-2026-59538Critical
The GamiPress plugin for WordPress version 7.9.7 and earlier contains an unauthenticated SQL injection vulnerability.
- CVE-2026-16091Medium
The GamiPress plugin for WordPress up to version 7.9.9.1 contains a Stored Cross-Site Scripting (XSS) vulnerability via the 'gamipress_rank' shortcode. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts that execute whenever a user accesses an injected page.
- CVE-2026-13450Medium
The GamiPress plugin for WordPress up to version 7.9.4 is vulnerable to Insecure Direct Object Reference (IDOR) via the 'access' parameter due to missing validation on a user-controlled key. Unauthenticated attackers can view private GamiPress activity logs, including badge earnings, points balance changes, and events from integrated plugins like WooCommerce, LearnDash, and BuddyPress.
- CVE-2026-48874High
GamiPress versions up to 7.8.7 contain a SQL Injection vulnerability that can be exploited by subscribers.
- CVE-2026-24546Medium
Missing authorization in the GamiPress plugin allows exploiting incorrectly configured access control security levels. The vulnerability affects versions from n/a through 7.6.3.
Original NVD description (English source)
The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'heading_size' Shortcode Attribute in 'gamipress_achievement' in all versions up to, and including, 7.9.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. WordPress save-time wp_kses_post does not neutralize this payload because the injected value is stored inside a shortcode attribute rather than as a raw HTML tag, and is only emitted into HTML at render time without escaping.