316 matches found
CVE-2026-94177
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Ruben Garcia GamiPress gamipress allows Blind SQL Injection.This issue affects GamiPress: from n/a through 8.0.2...
EUVD-2026-89842
Unauthenticated SQL Injection in GamiPress = 8.0.2 versions...
CVE-2026-94177 WordPress GamiPress plugin <= 8.0.2 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Ruben Garcia GamiPress gamipress allows Blind SQL Injection.This issue affects GamiPress: from n/a through 8.0.2...
CVE-2026-94177 WordPress GamiPress plugin <= 8.0.2 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Ruben Garcia GamiPress gamipress allows Blind SQL Injection.This issue affects GamiPress: from n/a through 8.0.2...
CVE-2026-94177
The GamiPress plugin for WordPress, versions
CVE-2026-94177: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Ruben Garcia GamiPress gamipress allows Blind SQL Injection.This issue affects GamiPress: from n/a through 8.0.2...
PT-2026-103174
Unauthenticated SQL Injection in GamiPress = 8.0.2 versions...
WordPress GamiPress plugin <= 8.0.2 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Bruno Alvarenga in WordPress Plugin GamiPress versions = 8.0.2...
CVE-2026-15439
The GamiPress plugin for WordPress is vulnerable to authenticated Subscriber+ SQL Injection via the 'q' parameter of the wpForo integration AJAX selector action gamipresswpforogetposts in versions up to, and including, 7.9.7. The value is passed only through $wpdb-esclike and interpolated directl...
EUVD-2026-76139
The GamiPress plugin for WordPress is vulnerable to authenticated Subscriber+ SQL Injection via the 'q' parameter of the wpForo integration AJAX selector action gamipresswpforogetposts in versions up to, and including, 7.9.7. The value is passed only through $wpdb-esclike and interpolated directl...
CVE-2026-15439 GamiPress <= 7.9.7 - Authenticated (Subscriber+) SQL Injection
The GamiPress plugin for WordPress is vulnerable to authenticated Subscriber+ SQL Injection via the 'q' parameter of the wpForo integration AJAX selector action gamipresswpforogetposts in versions up to, and including, 7.9.7. The value is passed only through $wpdb-esclike and interpolated directl...
CVE-2026-15439 GamiPress <= 7.9.7 - Authenticated (Subscriber+) SQL Injection
The GamiPress plugin for WordPress is vulnerable to authenticated Subscriber+ SQL Injection via the 'q' parameter of the wpForo integration AJAX selector action gamipresswpforogetposts in versions up to, and including, 7.9.7. The value is passed only through $wpdb-esclike and interpolated directl...
CVE-2026-15439
The GamiPress WordPress plugin (versions up to and including 7.9.7 ) is vulnerable to authenticated SQL injection via the q parameter in the wpForo integration AJAX action gamipress_wpforo_get_posts. The input is filtered only by $wpdb->esc_like() and interpolated directly into a single-quoted...
PT-2026-89895
The GamiPress plugin for WordPress is vulnerable to authenticated Subscriber+ SQL Injection via the 'q' parameter of the wpForo integration AJAX selector action gamipress wpforo get posts in versions up to, and including, 7.9.7. The value is passed only through $wpdb-esc like and interpolated...
CVE-2026-15439: Improper Neutralization of Special Elements used in an SQL Command
The GamiPress plugin for WordPress is vulnerable to authenticated Subscriber+ SQL Injection via the 'q' parameter of the wpForo integration AJAX selector action gamipresswpforogetposts in versions up to, and including, 7.9.7. The value is passed only through $wpdb-esclike and interpolated directl...
WordPress GamiPress plugin < 7.9.9.6 - Subscriber+ Arbitrary User Points and Achievement Award vulnerability
Subscriber+ Arbitrary User Points and Achievement Award vulnerability discovered by Shivamani Vastrala in WordPress Plugin GamiPress versions 7.9.9.6...
CVE-2026-77764
The GamiPress WordPress plugin before 7.9.9.6 does not properly restrict its video watch-tracking functionality, allowing users with a role as low as Subscriber to award the configured gamification points, achievements and ranks to arbitrary users including administrators, and to accrue them...
CVE-2026-77764
The GamiPress WordPress plugin, in versions prior to 7.9.9.6 , contains an authorization bypass vulnerability in its video watch-tracking functionality . This flaw allows users with low-level privileges, such as Subscriber , to award configured gamification points, achievements, and ranks to arbi...
EUVD-2026-69836
The GamiPress WordPress plugin before 7.9.9.6 does not properly restrict its video watch-tracking functionality, allowing users with a role as low as Subscriber to award the configured gamification points, achievements and ranks to arbitrary users including administrators, and to accrue them...
CVE-2026-77764 GamiPress < 7.9.9.6 - Subscriber+ Arbitrary User Points and Achievement Award via Watch-Video Listeners
The GamiPress WordPress plugin before 7.9.9.6 does not properly restrict its video watch-tracking functionality, allowing users with a role as low as Subscriber to award the configured gamification points, achievements and ranks to arbitrary users including administrators, and to accrue them...