Gamipress Vulnerabilities

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'heading_size' Shortcode Attribute in 'gamipress_achievement' in all versions up to, and including, 7.9.9.1 due to insufficient input sanitization and out...

CVSS:

6.4

Affected:

up to 7.9.9.1

Fixed in:

7.9.9.2

Disclosed:

Jul 31, 2026

CVE-2026-16090 on NVD →

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gamipress_rank' Shortcode in all versions up to, and including, 7.9.9.1 due to insufficient input sanitization and output escaping. This makes it pos...

CVSS:

6.4

Affected:

up to 7.9.9.1

Fixed in:

7.9.9.2

Disclosed:

Jul 31, 2026

CVE-2026-16091 on NVD →

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'heading_size' Shortcode Attribute in all versions up to, and including, 7.9.9.1 due to insufficient input sanitization and output escaping. This makes it...

CVSS:

6.4

Affected:

up to 7.9.9.1

Fixed in:

7.9.9.2

Disclosed:

Jul 27, 2026

CVE-2026-15730 on NVD →

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 7.9.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes...

CVSS:

7.5

Affected:

up to 7.9.7

Fixed in:

7.9.8

Disclosed:

Jul 23, 2026

CVE-2026-59538 on NVD →

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 7.9.4 via the 'access' parameter due to missing validation on a user controlled key. This makes it possible for una...

CVSS:

5.3

Affected:

up to 7.9.4

Fixed in:

7.9.5

Disclosed:

Jul 8, 2026

CVE-2026-13450 on NVD →

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 7.8.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes...

CVSS:

6.5

Affected:

up to 7.8.7

Fixed in:

7.8.8

Disclosed:

Jun 2, 2026

CVE-2026-48874 on NVD →

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 7.6.3. This makes it possible for unauthenticated attackers to perform an unauthoriz...

CVSS:

5.3

Affected:

up to 7.6.3

Fixed in:

7.6.4

Disclosed:

May 25, 2026

CVE-2026-24546 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in Ruben Garcia GamiPress gamipress allows Cross Site Request Forgery.This issue affects GamiPress: from n/a through <= 7.6.6.

Affected:

up to 7.6.6

Fix:

No patched version reported

Disclosed:

Mar 13, 2026

CVE-2026-32420 on NVD →

The GamiPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 7.6.6. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged request granted they can trick a...

CVSS:

4.3

Affected:

up to 7.6.6

Fixed in:

7.6.7

Disclosed:

Feb 26, 2026

CVE-2026-32420 on NVD →

[en] The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the gamipress_ajax_get_posts and gamipress_ajax_get_users functions in all versions up to, and including, 7.6.1. Thi...

Affected:

up to 7.6.2

Fixed in:

7.6.2

Disclosed:

Jan 6, 2026

CVE-2025-13812 on NVD →

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the gamipress_ajax_get_posts and gamipress_ajax_get_users functions in all versions up to, and including, 7.6.1. This mak...

CVSS:

4.3

Affected:

up to 7.6.1

Fixed in:

7.6.2

Disclosed:

Jan 5, 2026

CVE-2025-13812 on NVD →

[en] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia GamiPress allows SQL Injection. This issue affects GamiPress: from n/a through 7.4.5.

Affected:

up to 7.4.6

Fixed in:

7.4.6

Disclosed:

Jun 6, 2025

CVE-2025-49326 on NVD →

The GamiPress plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 7.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and abo...

CVSS:

4.9

Affected:

up to 7.4.5

Fixed in:

7.4.6

Disclosed:

Jun 5, 2025

CVE-2025-49326 on NVD →

The GamiPress plugin for WordPress is vulnerable to Local File Inclusion via the gamipress_logs_shortcode() function in versions up to, and including, 7.3.7. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the ex...

CVSS:

8.8

Affected:

up to 7.3.7

Fixed in:

7.3.8

Disclosed:

May 7, 2025

CVE-2025-47508 on NVD →

[en] Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Ruben Garcia GamiPress allows PHP Local File Inclusion. This issue affects GamiPress: from n/a through 7.3.7.

Affected:

up to 7.3.8

Fixed in:

7.3.8

Disclosed:

May 7, 2025

CVE-2025-47508 on NVD →

[en] The The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution via the gamipress_ajax_get_logs() function in all versions up to, and including, 7.2.1. This is due to the software allowing users to execute an ac...

Affected:

up to 7.2.2

Fixed in:

7.2.2

Disclosed:

Jan 22, 2025

CVE-2024-13495 on NVD →

[en] The The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution via gamipress_do_shortcode() function in all versions up to, and including, 7.2.1. This is due to the software allowing users to execute an action...

Affected:

up to 7.2.2

Fixed in:

7.2.2

Disclosed:

Jan 22, 2025

CVE-2024-13499 on NVD →

[en] The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 7.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient p...

Affected:

up to 7.2.2

Fixed in:

7.2.2

Disclosed:

Jan 22, 2025

CVE-2024-13496 on NVD →

The The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution via gamipress_do_shortcode() function in all versions up to, and including, 7.2.1. This is due to the software allowing users to execute an action that...

CVSS:

7.3

Affected:

up to 7.2.1

Fixed in:

7.2.2

Disclosed:

Jan 21, 2025

CVE-2024-13499 on NVD →

The The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution via the gamipress_ajax_get_logs() function in all versions up to, and including, 7.2.1. This is due to the software allowing users to execute an action...

CVSS:

7.3

Affected:

up to 7.2.1

Fixed in:

7.2.2

Disclosed:

Jan 21, 2025

CVE-2024-13495 on NVD →

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 7.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient prepar...

CVSS:

7.5

Affected:

up to 7.3.1

Fixed in:

7.3.2

Disclosed:

Jan 21, 2025

CVE-2024-13496 on NVD →

[en] The The GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution via gamipress_get_user_earnings AJAX action in all versions up to, and including, 7.1.5. This is due to the software allowing users to execu...

Affected:

up to 7.1.6

Fixed in:

7.1.6

Disclosed:

Nov 19, 2024

CVE-2024-11036 on NVD →

The The GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution via gamipress_get_user_earnings AJAX action in all versions up to, and including, 7.1.5. This is due to the software allowing users to execute an...

CVSS:

7.3

Affected:

up to 7.1.5

Fixed in:

7.1.6

Disclosed:

Nov 18, 2024

CVE-2024-11036 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in GamiPress.This issue affects GamiPress: from n/a through 2.5.6.

Affected:

up to 2.5.7

Fixed in:

2.5.7

Disclosed:

Jun 19, 2024

CVE-2023-25697 on NVD →

[en] The GamiPress WordPress plugin before 6.8.9's access control mechanism fails to properly restrict access to its settings, permitting Authors to manipulate requests and extend access to lower privileged users, like Subscribers, despite initial settings prohibiting such access. This vulnerability resembles broken a...

Affected:

up to 6.8.9

Fixed in:

6.8.9

Disclosed:

Apr 29, 2024

CVE-2024-2505 on NVD →

[en] The GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 6.9.0 due to insufficient input sanitization and output escaping on user suppl...

Affected:

up to 6.9.1

Fixed in:

6.9.1

Disclosed:

Apr 9, 2024

CVE-2024-2783 on NVD →

The GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to broken access control in all versions up to, and including, 6.8.8. This is due to the plugin not properly restricting specific actions to authorized users. This makes it possible...

CVSS:

4.3

Affected:

up to 6.8.8

Fixed in:

6.8.9

Disclosed:

Apr 8, 2024

CVE-2024-2505 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in GamiPress.This issue affects GamiPress: from n/a through 6.8.5.

Affected:

up to 6.8.6

Fixed in:

6.8.6

Disclosed:

Mar 29, 2024

CVE-2024-30455 on NVD →

The GamiPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.8.5. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged request granted they can trick a site administ...

CVSS:

4.3

Affected:

up to 6.8.5

Fixed in:

6.8.6

Disclosed:

Mar 28, 2024

CVE-2024-30455 on NVD →

The GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 6.9.0 due to insufficient input sanitization and output escaping on user supplied a...

CVSS:

6.4

Affected:

up to 6.9.0

Fixed in:

6.9.1

Disclosed:

Mar 27, 2024

CVE-2024-2783 on NVD →

[en] The GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to SQL Injection via the 'achievement_types' attribute of the gamipress_earnings shortcode in all versions up to, and including, 6.8.6 due to insufficient escaping on the user s...

Affected:

up to 6.8.7

Fixed in:

6.8.7

Disclosed:

Mar 20, 2024

CVE-2024-1799 on NVD →

The GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to SQL Injection via the 'achievement_types' attribute of the gamipress_earnings shortcode in all versions up to, and including, 6.8.6 due to insufficient escaping on the user suppli...

CVSS:

8.8

Affected:

up to 6.8.6

Fixed in:

6.8.7

Disclosed:

Mar 19, 2024

CVE-2024-1799 on NVD →

[en] Missing Authorization vulnerability in GamiPress GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress.This issue affects GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress: from n/a through 2.5.6.

Affected:

up to 2.5.7

Fixed in:

2.5.7

Disclosed:

Dec 19, 2023

CVE-2023-25715 on NVD →

[en] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in GamiPress gamipress allows SQL Injection.This issue affects GamiPress: from n/a through 2.5.7.

Affected:

up to 2.5.7.1

Fixed in:

2.5.7.1

Disclosed:

Oct 31, 2023

CVE-2023-24000 on NVD →

The GamiPress plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.5.7 due to insufficient escaping on the user supplied parameter '$qv[$field_id]' and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional S...

CVSS:

9.8

Affected:

up to 2.5.7

Fixed in:

2.5.7.1

Disclosed:

Feb 14, 2023

CVE-2023-24000 on NVD →

The GamiPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5.6. This is due to missing or incorrect nonce validation on the bulk_delete function. This makes it possible for unauthenticated attackers to invoke this function via forged request granted they can trick...

CVSS:

4.3

Affected:

up to 2.5.6

Fixed in:

2.5.7

Disclosed:

Feb 14, 2023

CVE-2023-25697 on NVD →

The GamiPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5.6. This is due to missing or incorrect nonce validation on the bulk_delete function. This makes it possible for unauthenticated attackers to invoke this function via forged request granted they can trick...

Affected:

up to 2.5.7

Fixed in:

2.5.7

Disclosed:

Feb 14, 2023

The GamiPress plugin for WordPress is vulnerable to unauthorized modification of user data due to a missing capability check on the gamipress_ajax_profile_update_user_points function in versions up to, and including, 2.5.6. This makes it possible for authenticated attackers with subscriber-level access or higher to man...

CVSS:

4.3

Affected:

up to 2.5.6

Fixed in:

2.5.7

Disclosed:

Feb 13, 2023

CVE-2023-25715 on NVD →

Update the WordPress GamiPress plugin to the latest available version (at least 2.5.1). An unknown person discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress GamiPress Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under thei...

Affected:

up to 2.5.1

Fixed in:

2.5.1

Disclosed:

Jan 14, 2023

The GamiPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5.0. This is due to missing or incorrect nonce validation on the delete function. This makes it possible for unauthenticated attackers to invoke this function via forged request granted they can trick a si...

CVSS:

5.4

Affected:

up to 2.5.0

Fixed in:

2.5.1

Disclosed:

Jan 12, 2023

The GamiPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5.0. This is due to missing or incorrect nonce validation on the delete function. This makes it possible for unauthenticated attackers to invoke this function via forged request granted they can trick a si...

Affected:

up to 2.5.1

Fixed in:

2.5.1

Disclosed:

Jan 12, 2023