Rubengc
Monthly
Authenticated SQL injection in GamiPress ≤7.9.7 allows a Subscriber-level WordPress user to exfiltrate the entire site database through a boolean-based blind injection channel in the wpForo integration AJAX handler. The flaw exploits a subtle interaction between WordPress core magic-quote processing and MySQL backslash semantics: `$wpdb->esc_like()` is called after magic quotes have already escaped a single quote to `\'`, producing `\\'` — which MySQL parses as one literal backslash plus a live closing quote, escaping the LIKE string context. No public exploit or CISA KEV listing has been identified at time of analysis, but Wordfence has confirmed the vulnerability with direct source-code references.
Authorization bypass in the AutomatorWP WordPress plugin (all versions ≤ 5.8.4) allows any authenticated subscriber to retrieve the site's Campaign Monitor mailing list catalog - list IDs and names - that should be restricted to users holding the plugin's manager capability. The flaw is compounded by unconditional nonce emission via wp_localize_script to every WordPress admin-area visitor, meaning the authentication token required to invoke the vulnerable AJAX endpoints is freely available to any registered user visiting /wp-admin/profile.php. No active exploitation is confirmed (not listed in CISA KEV) and no public exploit code was cited, though Wordfence identified and reported the issue with specific vulnerable code line references.
Authorization bypass in AutomatorWP WordPress plugin (all versions through 5.8.4) exposes ConvertKit integration credentials to any subscriber-level authenticated user. The ConvertKit AJAX endpoints in the plugin's integration layer perform no capability verification, and the nonce required to invoke them is embedded in every admin page load, eliminating the nonce's protective value for any authenticated user who can reach /wp-admin. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, though the attack primitive is trivially reproducible from the referenced source code.
Stored Cross-Site Scripting in GamiPress WordPress plugin (versions through 7.9.9.1) enables contributor-level authenticated users to inject persistent JavaScript payloads via the 'gamipress_rank' shortcode, which then executes silently in any visitor's browser upon page load. The CVSS Scope Changed metric (S:C) reflects that injected scripts escape the plugin's component boundary and can compromise administrator sessions or site visitors. No public exploit code has been identified at time of analysis, and this CVE does not appear in CISA KEV.
Stored Cross-Site Scripting in the GamiPress WordPress plugin (all versions through 7.9.9.1) permits contributor-level authenticated users to inject persistent JavaScript payloads via the `heading_size` attribute of the `gamipress_achievement` shortcode. The root cause is a WordPress-specific sanitization gap: wp_kses_post strips disallowed HTML at save time but cannot neutralize payloads embedded inside shortcode attribute strings, which are only interpolated into HTML output at render time without escaping — meaning the injected script executes in any visitor's browser who loads the affected page. No public exploit code or CISA KEV listing has been identified at time of analysis, but the stored nature of the payload and the low privilege bar make this a meaningful risk on multi-author WordPress deployments.
Stored cross‑site scripting in the GamiPress WordPress plugin (≤ 7.9.9.1) allows authenticated attackers with contributor‑level access to inject JavaScript via the heading_size shortcode attribute. The wp_kses_post sanitizer applied at save‑time does not neutralize the payload because the malicious HTML is generated dynamically by the shortcode handler during page rendering, bypassing all input filtering. No active exploitation or public exploit code has been identified at the time of analysis.
Unauthenticated information disclosure in the GamiPress WordPress plugin (all versions through 7.9.4) allows any site visitor to read private activity log entries belonging to arbitrary users, including badge earnings, points balance changes, WooCommerce purchase events, LearnDash course completions, and BuddyPress activity records. The IDOR flaw in the 'access' parameter is rendered trivially exploitable because the sole authentication gate - a gamipress nonce - is deliberately broadcast to every front-end visitor via wp_localize_script, meaning no credential or privilege is required beyond loading any page on the target site. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the near-zero exploitation complexity makes it a practical mass-exploitation candidate against any unpatched deployment.
Authenticated SQL injection in GamiPress ≤7.9.7 allows a Subscriber-level WordPress user to exfiltrate the entire site database through a boolean-based blind injection channel in the wpForo integration AJAX handler. The flaw exploits a subtle interaction between WordPress core magic-quote processing and MySQL backslash semantics: `$wpdb->esc_like()` is called after magic quotes have already escaped a single quote to `\'`, producing `\\'` — which MySQL parses as one literal backslash plus a live closing quote, escaping the LIKE string context. No public exploit or CISA KEV listing has been identified at time of analysis, but Wordfence has confirmed the vulnerability with direct source-code references.
Authorization bypass in the AutomatorWP WordPress plugin (all versions ≤ 5.8.4) allows any authenticated subscriber to retrieve the site's Campaign Monitor mailing list catalog - list IDs and names - that should be restricted to users holding the plugin's manager capability. The flaw is compounded by unconditional nonce emission via wp_localize_script to every WordPress admin-area visitor, meaning the authentication token required to invoke the vulnerable AJAX endpoints is freely available to any registered user visiting /wp-admin/profile.php. No active exploitation is confirmed (not listed in CISA KEV) and no public exploit code was cited, though Wordfence identified and reported the issue with specific vulnerable code line references.
Authorization bypass in AutomatorWP WordPress plugin (all versions through 5.8.4) exposes ConvertKit integration credentials to any subscriber-level authenticated user. The ConvertKit AJAX endpoints in the plugin's integration layer perform no capability verification, and the nonce required to invoke them is embedded in every admin page load, eliminating the nonce's protective value for any authenticated user who can reach /wp-admin. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, though the attack primitive is trivially reproducible from the referenced source code.
Stored Cross-Site Scripting in GamiPress WordPress plugin (versions through 7.9.9.1) enables contributor-level authenticated users to inject persistent JavaScript payloads via the 'gamipress_rank' shortcode, which then executes silently in any visitor's browser upon page load. The CVSS Scope Changed metric (S:C) reflects that injected scripts escape the plugin's component boundary and can compromise administrator sessions or site visitors. No public exploit code has been identified at time of analysis, and this CVE does not appear in CISA KEV.
Stored Cross-Site Scripting in the GamiPress WordPress plugin (all versions through 7.9.9.1) permits contributor-level authenticated users to inject persistent JavaScript payloads via the `heading_size` attribute of the `gamipress_achievement` shortcode. The root cause is a WordPress-specific sanitization gap: wp_kses_post strips disallowed HTML at save time but cannot neutralize payloads embedded inside shortcode attribute strings, which are only interpolated into HTML output at render time without escaping — meaning the injected script executes in any visitor's browser who loads the affected page. No public exploit code or CISA KEV listing has been identified at time of analysis, but the stored nature of the payload and the low privilege bar make this a meaningful risk on multi-author WordPress deployments.
Stored cross‑site scripting in the GamiPress WordPress plugin (≤ 7.9.9.1) allows authenticated attackers with contributor‑level access to inject JavaScript via the heading_size shortcode attribute. The wp_kses_post sanitizer applied at save‑time does not neutralize the payload because the malicious HTML is generated dynamically by the shortcode handler during page rendering, bypassing all input filtering. No active exploitation or public exploit code has been identified at the time of analysis.
Unauthenticated information disclosure in the GamiPress WordPress plugin (all versions through 7.9.4) allows any site visitor to read private activity log entries belonging to arbitrary users, including badge earnings, points balance changes, WooCommerce purchase events, LearnDash course completions, and BuddyPress activity records. The IDOR flaw in the 'access' parameter is rendered trivially exploitable because the sole authentication gate - a gamipress nonce - is deliberately broadcast to every front-end visitor via wp_localize_script, meaning no credential or privilege is required beyond loading any page on the target site. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the near-zero exploitation complexity makes it a practical mass-exploitation candidate against any unpatched deployment.