Executive brief
GamiPress, a WordPress plugin used to add gamification features like points and badges to websites, contains a security flaw that allows users with contributor-level access to inject malicious scripts into pages. These scripts execute automatically when other users, including administrators, view the affected content. This could lead to unauthorized actions being performed in the context of the victim's session or the theft of sensitive information.
Technical details
A Stored Cross-Site Scripting (XSS) vulnerability exists in the GamiPress plugin due to insufficient input sanitization and output escaping of the 'heading_size' attribute within the 'gamipress_achievement' shortcode. Authenticated attackers with contributor-level permissions or higher can inject arbitrary web scripts. Because the payload is stored within a shortcode attribute rather than raw HTML, it bypasses standard WordPress 'wp_kses_post' filters and is executed when the shortcode is rendered on the front end. The issue is addressed in versions following 7.9.9.1.
Affected products
- rubengc GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress up to, and including, 7.9.9.1
Timeline
- 2026-08-01: advisory: NVD publication date
- 2026-08-01: disclosed: Wordfence advisory published
References
- https://plugins.trac.wordpress.org/browser/gamipress/tags/7.9.9/includes/filters.php
- https://plugins.trac.wordpress.org/browser/gamipress/tags/7.9.9/includes/shortcodes/gamipress_achievement.php
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3619577%40gamipress&new=3619577%40gamipress
- https://www.wordfence.com/threat-intel/vulnerabilities/id/77727d02-796b-4c5b-ad5d-d1c366760abc?source=cve