Is CVE-2026-16090 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-16090 being exploited in the wild.

How severe is CVE-2026-16090?

Medium severity, with a CVSS score of 6.4, published 1 August 2026.

Which products and versions are affected?

GamiPress up to, and including, 7.9.9.1.

Is there a fix for CVE-2026-16090?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-16090 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-16090?

Check whether you run GamiPress at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-16090: GamiPress WordPress plugin stored XSS in gamipress_achievement shortcode

CVE-2026-16090 · Severity: medium · CVSS 6.4 · Published 2026-08-01

GamiPress, a WordPress plugin used to add gamification features like points and badges to websites, contains a security flaw that allows users with contributor-level access to inject malicious scripts into pages. These scripts execute automatically when other users, including administrators, view the affected content. This could lead to unauthorized actions being performed in the context of the victim's session or the theft of sensitive information.

Technologies: GamiPress. Vendors: GamiPress.

Quick answers

Is CVE-2026-16090 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-16090 being exploited in the wild.
How severe is CVE-2026-16090?: Medium severity, with a CVSS score of 6.4, published 1 August 2026.
Which products and versions are affected?: GamiPress up to, and including, 7.9.9.1.
Is there a fix for CVE-2026-16090?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-16090 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-16090?: Check whether you run GamiPress at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Stored Cross-Site Scripting (XSS) vulnerability exists in the GamiPress plugin due to insufficient input sanitization and output escaping of the 'heading_size' attribute within the 'gamipress_achievement' shortcode. Authenticated attackers with contributor-level permissions or higher can inject arbitrary web scripts. Because the payload is stored within a shortcode attribute rather than raw HTML, it bypasses standard WordPress 'wp_kses_post' filters and is executed when the shortcode is rendered on the front end. The issue is addressed in versions following 7.9.9.1.

Affected products

rubengc GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress up to, and including, 7.9.9.1

Timeline

2026-08-01: advisory: NVD publication date
2026-08-01: disclosed: Wordfence advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.