Executive brief
GamiPress is a popular WordPress plugin used to add gamification features like points and badges to websites. A security flaw allows users with contributor-level access or higher to plant malicious scripts on the site. These scripts execute automatically when other users, including administrators, visit the affected pages, potentially leading to unauthorized actions or data theft.
Technical details
The GamiPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on the 'heading_size' attribute within its shortcode handler. While WordPress typically applies 'wp_kses_post' filters during post saving, this vulnerability bypasses that protection because the malicious payload is stored as inert shortcode text and only rendered into dangerous HTML at runtime. Authenticated attackers with contributor-level permissions or higher can exploit this to inject arbitrary web scripts. The vulnerability exists in all versions up to and including 7.9.9.1.
Affected products
- rubengc GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress up to, and including, 7.9.9.1
Timeline
- 2026-07-28: disclosed
- 2026-07-28: advisory
References
- https://plugins.trac.wordpress.org/browser/gamipress/tags/7.9.8/includes/filters.php
- https://plugins.trac.wordpress.org/browser/gamipress/tags/7.9.8/includes/filters.php
- https://plugins.trac.wordpress.org/browser/gamipress/tags/7.9.8/includes/filters.php
- https://plugins.trac.wordpress.org/browser/gamipress/tags/7.9.8/includes/filters.php
- https://plugins.trac.wordpress.org/browser/gamipress/tags/7.9.8/includes/shortcodes/gamipress_points_types.php
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3619577%40gamipress&new=3619577%40gamipress
- https://www.wordfence.com/threat-intel/vulnerabilities/id/dedd24e6-ac0c-48cd-a76a-8fb61d2c3c0f?source=cve