GamiPress EUVD-2026-96094

Requires an authenticated account with subscriber-level privileges or higher on a WordPress site running GamiPress <= 7.9.4 with the plugin's YouTube integration in use, where the attacker injects a payload through the 'video_id' parameter handled in the YouTube integration's listeners/triggers code. Exploitation is limited by the authentication requirement (no anonymous exploitation) and by the need for a victim to subsequently load the page containing the stored payload for the script to execute; the elevated impact arises when that victim is a higher-privileged user such as an administrator.

This is a moderate-severity stored XSS (CVSS 6.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) that is a real but not urgent priority. The network attack vector and low complexity ease exploitation, but PR:L means an attacker must first hold at least a subscriber-level account on the target WordPress site, which meaningfully limits mass, unauthenticated exploitation. The scope change (S:C) and the stored nature raise impact because injected script executes in the browsers of other users (potentially higher-privileged administrators) who view the affected page. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - this is a Wordfence-reported, likely researcher-discovered issue rather than a weaponized threat. The limited confidentiality/integrity impact (C:L/I:L) and absence of availability impact keep this below critical. Net: patch in normal cadence; it is a legitimate privilege-escalation-via-XSS risk on multi-user sites but does not warrant emergency response absent exploitation signals.

An attacker registers or obtains a subscriber-level account on a WordPress site running GamiPress <= 7.9.4 and submits a crafted 'video_id' value containing a malicious script payload through the YouTube integration. The payload is stored without sanitization and later executes in the browser of any user - potentially an administrator - who views the affected page, enabling session/cookie theft or admin actions in the victim's context. No public exploit code was identified at time of analysis.