Executive brief
GamiPress is a WordPress plugin used to add gamification features like points, badges, and ranks to websites. A security vulnerability in this plugin allows users with contributor-level access or higher to inject malicious scripts into website pages. If exploited, these scripts will run in the browsers of other users who visit the affected pages, potentially leading to unauthorized actions or data theft.
Technical details
The GamiPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to improper neutralization of user-supplied input within the 'gamipress_rank' shortcode. The vulnerability exists in versions up to and including 7.9.9.1. An authenticated attacker with contributor-level permissions or higher can exploit this by injecting arbitrary web scripts into pages via the shortcode attributes. Because the input is not properly sanitized or escaped upon output, the script executes in the context of any user who views the compromised page. A patch has been released in the form of a changeset to address the sanitization logic.
Affected products
- rubengc GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress up to, and including, 7.9.9.1
Timeline
- 2026-08-01: disclosed
- 2026-08-01: advisory
References
- https://plugins.trac.wordpress.org/browser/gamipress/tags/7.9.9/includes/filters.php
- https://plugins.trac.wordpress.org/browser/gamipress/tags/7.9.9/includes/shortcodes/gamipress_rank.php
- https://plugins.trac.wordpress.org/browser/gamipress/tags/7.9.9/includes/shortcodes/gamipress_rank.php
- https://plugins.trac.wordpress.org/browser/gamipress/tags/7.9.9/includes/template-functions.php
- https://plugins.trac.wordpress.org/browser/gamipress/tags/7.9.9/templates/rank.php
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3619577%40gamipress&new=3619577%40gamipress
- https://www.wordfence.com/threat-intel/vulnerabilities/id/d9f257a9-d447-407c-83ae-3cc99254be3f?source=cve