CVE-2026-59538

The GamiPress plugin for WordPress is vulnerable to authenticated (Subscriber+) SQL Injection via the 'q' parameter of the wpForo integration AJAX selector (action gamipress_wpforo_get_posts) in versions up to, and including, 7.9.7. The value is passed only through $wpdb->esc_like() and interpolated directly into a single-quoted LIKE clause with no %s placeholder, allowing the attacker to break out of the string and inject boolean-based SQL.

The GamiPress plugin for WordPress up to version 7.9.9.1 contains a Stored Cross-Site Scripting (XSS) vulnerability via the 'gamipress_rank' shortcode. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts that execute whenever a user accesses an injected page.

The GamiPress plugin for WordPress is vulnerable to stored XSS via the 'heading_size' shortcode attribute in 'gamipress_achievement'. Attackers with contributor-level access can inject arbitrary scripts that execute when a user visits the page.

The GamiPress plugin for WordPress up to version 7.9.4 is vulnerable to Insecure Direct Object Reference (IDOR) via the 'access' parameter due to missing validation on a user-controlled key. Unauthenticated attackers can view private GamiPress activity logs, including badge earnings, points balance changes, and events from integrated plugins like WooCommerce, LearnDash, and BuddyPress.

GamiPress versions up to 7.8.7 contain a SQL Injection vulnerability that can be exploited by subscribers.

Missing authorization in the GamiPress plugin allows exploiting incorrectly configured access control security levels. The vulnerability affects versions from n/a through 7.6.3.