CVE-2026-16090

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'headingsize' Shortcode Attribute in 'gamipressachievement' in all versions up to, and including, 7.9.9.1 due to insufficient input...

CVE-2026-16090

The CVE affects the WordPress plugin GamiPress (Gamification) up to version 7.9.9.1. It describes a Stored Cross-Site Scripting vulnerability via the heading_size attribute of the gamipress_achievement shortcode. The root cause is insufficient input sanitization and output escaping, with the payl...

CVE-2026-16090 GamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via gamipress_achievement Shortcode

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'headingsize' Shortcode Attribute in 'gamipressachievement' in all versions up to, and including, 7.9.9.1 due to insufficient input...

CVE-2026-16090 GamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via gamipress_achievement Shortcode

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'headingsize' Shortcode Attribute in 'gamipressachievement' in all versions up to, and including, 7.9.9.1 due to insufficient input...

CVE-2026-16090

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'headingsize' Shortcode Attribute in 'gamipressachievement' in all versions up to, and including, 7.9.9.1 due to insufficient input...

EUVD-2026-51750

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'headingsize' Shortcode Attribute in 'gamipressachievement' in all versions up to, and including, 7.9.9.1 due to insufficient input...

PT-2026-67096

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'heading size' Shortcode Attribute in 'gamipress achievement' in all versions up to, and including, 7.9.9.1 due to insufficient inp...

CVE-2026-15730

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'headingsize' Shortcode Attribute in all versions up to, and including, 7.9.9.1 due to insufficient input sanitization and output...

EUVD-2026-49713

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'headingsize' Shortcode Attribute in all versions up to, and including, 7.9.9.1 due to insufficient input sanitization and output...

CVE-2026-15730 GamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'heading_size' Shortcode Attribute

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'headingsize' Shortcode Attribute in all versions up to, and including, 7.9.9.1 due to insufficient input sanitization and output...

CVE-2026-15730

GamiPress (WordPress plugin)

CVE-2026-15730

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'headingsize' Shortcode Attribute in all versions up to, and including, 7.9.9.1 due to insufficient input sanitization and output...

PT-2026-65407

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'heading size' Shortcode Attribute in all versions up to, and including, 7.9.9.1 due to insufficient input sanitization and output...