Gamipress Gamification Plugin To Reward Points Achievements Badges Ranks In Wordpress
Monthly
Stored Cross-Site Scripting in GamiPress WordPress plugin (versions through 7.9.9.1) enables contributor-level authenticated users to inject persistent JavaScript payloads via the 'gamipress_rank' shortcode, which then executes silently in any visitor's browser upon page load. The CVSS Scope Changed metric (S:C) reflects that injected scripts escape the plugin's component boundary and can compromise administrator sessions or site visitors. No public exploit code has been identified at time of analysis, and this CVE does not appear in CISA KEV.
Stored Cross-Site Scripting in the GamiPress WordPress plugin (all versions through 7.9.9.1) permits contributor-level authenticated users to inject persistent JavaScript payloads via the `heading_size` attribute of the `gamipress_achievement` shortcode. The root cause is a WordPress-specific sanitization gap: wp_kses_post strips disallowed HTML at save time but cannot neutralize payloads embedded inside shortcode attribute strings, which are only interpolated into HTML output at render time without escaping — meaning the injected script executes in any visitor's browser who loads the affected page. No public exploit code or CISA KEV listing has been identified at time of analysis, but the stored nature of the payload and the low privilege bar make this a meaningful risk on multi-author WordPress deployments.
Stored cross‑site scripting in the GamiPress WordPress plugin (≤ 7.9.9.1) allows authenticated attackers with contributor‑level access to inject JavaScript via the heading_size shortcode attribute. The wp_kses_post sanitizer applied at save‑time does not neutralize the payload because the malicious HTML is generated dynamically by the shortcode handler during page rendering, bypassing all input filtering. No active exploitation or public exploit code has been identified at the time of analysis.
Unauthenticated information disclosure in the GamiPress WordPress plugin (all versions through 7.9.4) allows any site visitor to read private activity log entries belonging to arbitrary users, including badge earnings, points balance changes, WooCommerce purchase events, LearnDash course completions, and BuddyPress activity records. The IDOR flaw in the 'access' parameter is rendered trivially exploitable because the sole authentication gate - a gamipress nonce - is deliberately broadcast to every front-end visitor via wp_localize_script, meaning no credential or privilege is required beyond loading any page on the target site. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the near-zero exploitation complexity makes it a practical mass-exploitation candidate against any unpatched deployment.
Stored Cross-Site Scripting in GamiPress WordPress plugin (versions through 7.9.9.1) enables contributor-level authenticated users to inject persistent JavaScript payloads via the 'gamipress_rank' shortcode, which then executes silently in any visitor's browser upon page load. The CVSS Scope Changed metric (S:C) reflects that injected scripts escape the plugin's component boundary and can compromise administrator sessions or site visitors. No public exploit code has been identified at time of analysis, and this CVE does not appear in CISA KEV.
Stored Cross-Site Scripting in the GamiPress WordPress plugin (all versions through 7.9.9.1) permits contributor-level authenticated users to inject persistent JavaScript payloads via the `heading_size` attribute of the `gamipress_achievement` shortcode. The root cause is a WordPress-specific sanitization gap: wp_kses_post strips disallowed HTML at save time but cannot neutralize payloads embedded inside shortcode attribute strings, which are only interpolated into HTML output at render time without escaping — meaning the injected script executes in any visitor's browser who loads the affected page. No public exploit code or CISA KEV listing has been identified at time of analysis, but the stored nature of the payload and the low privilege bar make this a meaningful risk on multi-author WordPress deployments.
Stored cross‑site scripting in the GamiPress WordPress plugin (≤ 7.9.9.1) allows authenticated attackers with contributor‑level access to inject JavaScript via the heading_size shortcode attribute. The wp_kses_post sanitizer applied at save‑time does not neutralize the payload because the malicious HTML is generated dynamically by the shortcode handler during page rendering, bypassing all input filtering. No active exploitation or public exploit code has been identified at the time of analysis.
Unauthenticated information disclosure in the GamiPress WordPress plugin (all versions through 7.9.4) allows any site visitor to read private activity log entries belonging to arbitrary users, including badge earnings, points balance changes, WooCommerce purchase events, LearnDash course completions, and BuddyPress activity records. The IDOR flaw in the 'access' parameter is rendered trivially exploitable because the sole authentication gate - a gamipress nonce - is deliberately broadcast to every front-end visitor via wp_localize_script, meaning no credential or privilege is required beyond loading any page on the target site. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the near-zero exploitation complexity makes it a practical mass-exploitation candidate against any unpatched deployment.