# CVE-2026-14379: GamiPress stored cross-site scripting in video_id parameter

Source: https://junglewise.ai/threats/cve-2026-14379-the-gamipress-gamification-plugin-to-reward-points-achievements  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-10. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-14379 · Severity: medium · CVSS 6.4 · Published 2026-10-10

GamiPress is a WordPress plugin that gamifies websites by awarding points, achievements, and badges to users. The plugin fails to properly sanitize user input in the video_id parameter, allowing attackers with subscriber-level access to inject malicious scripts that execute when other users view affected pages, potentially stealing credentials or session data.

Technologies: [GamiPress](https://junglewise.ai/threats/technologies/gamipress). Vendors: [GamiPress](https://junglewise.ai/threats/vendors/gamipress).

## Quick answers

**Is CVE-2026-14379 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-14379 being exploited in the wild.

**How severe is CVE-2026-14379?** Medium severity, with a CVSS score of 6.4, published 10 October 2026.

**Which products and versions are affected?** GamiPress up to 7.9.4.

**Is there a fix for CVE-2026-14379?** Yes: fixed in 7.9.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-14379 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-14379?** Check whether you run GamiPress at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 7.9.5

## Technical details

This is a stored cross-site scripting (XSS) vulnerability in the GamiPress WordPress plugin versions up to 7.9.4. The vulnerability exists in the video_id parameter due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level privileges can inject arbitrary JavaScript that persists in the database and executes in the browsers of all users who access the injected page.

## Affected products

- GamiPress GamiPress up to 7.9.4

## Timeline

- 2026-10-10: disclosed
- 2026-10-10: patched: Fix available in version 7.9.5

## References

- [https://plugins.trac.wordpress.org/browser/gamipress/tags/7.9.5/integrations/youtube/includes/listeners.php](https://plugins.trac.wordpress.org/browser/gamipress/tags/7.9.5/integrations/youtube/includes/listeners.php)
- [https://plugins.trac.wordpress.org/browser/gamipress/tags/7.9.5/integrations/youtube/includes/triggers.php](https://plugins.trac.wordpress.org/browser/gamipress/tags/7.9.5/integrations/youtube/includes/triggers.php)

## Related threats

- [GamiPress SQL Injection via Gravity Forms field parameter](https://junglewise.ai/threats/cve-2026-121792-the-gamipress-gamification-plugin-to-reward-points-badges-ranks)
- [GamiPress SQL injection in REST API](https://junglewise.ai/threats/cve-2026-94177-unauthenticated-sql-injection-in-gamipress-8-0-2-versions)
- [GamiPress SQL Injection in wpForo AJAX selector](https://junglewise.ai/threats/cve-2026-15439-gamipress-sql-injection-in-wpforo-ajax-selector)
- [GamiPress arbitrary user points and achievement award via video watch tracking](https://junglewise.ai/threats/cve-2026-77764-gamipress-arbitrary-user-points-and-achievement-award-via-video)
- [GamiPress WordPress plugin stored XSS in gamipress_rank shortcode](https://junglewise.ai/threats/cve-2026-16091-gamipress-wordpress-plugin-stored-xss-in-gamipress-rank-shortcode)