CVE-2026-16091
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The GamiPress plugin for WordPress up to version 7.9.9.1 contains a Stored Cross-Site Scripting (XSS) vulnerability via the 'gamipress_rank' shortcode. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts that execute whenever a user accesses an injected page.
Risk Assessment
Attackers can inject malicious scripts that execute on page access, potentially leading to session theft, redirects, or other user-targeted attacks.
Recommendation
Update the GamiPress plugin to the latest version and avoid using shortcodes with user-supplied attributes.
Other vulnerabilities in GamiPress
See all- CVE-2026-59538Critical
The GamiPress plugin for WordPress version 7.9.7 and earlier contains an unauthenticated SQL injection vulnerability.
- CVE-2026-16090Medium
The GamiPress plugin for WordPress is vulnerable to stored XSS via the 'heading_size' shortcode attribute in 'gamipress_achievement'. Attackers with contributor-level access can inject arbitrary scripts that execute when a user visits the page.
- CVE-2026-13450Medium
The GamiPress plugin for WordPress up to version 7.9.4 is vulnerable to Insecure Direct Object Reference (IDOR) via the 'access' parameter due to missing validation on a user-controlled key. Unauthenticated attackers can view private GamiPress activity logs, including badge earnings, points balance changes, and events from integrated plugins like WooCommerce, LearnDash, and BuddyPress.
- CVE-2026-48874High
GamiPress versions up to 7.8.7 contain a SQL Injection vulnerability that can be exploited by subscribers.
- CVE-2026-24546Medium
Missing authorization in the GamiPress plugin allows exploiting incorrectly configured access control security levels. The vulnerability affects versions from n/a through 7.6.3.
Original NVD description (English source)
The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gamipress_rank' Shortcode in all versions up to, and including, 7.9.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.