CVE-2026-121792

The GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI plugin for WordPress is vulnerable to generic SQL Injection via the 'input. Gravity Forms name-field part, or list-field row' parameter in all versions up to, and including, 8.1.1 due to insufficient...

CVE-2026-121792

The GamiPress – Gamification plugin for WordPress is vulnerable to a generic SQL Injection in all versions up to and including 8.1.1 . The root cause is insufficient escaping of the user-supplied input_. parameter and a lack of sufficient preparation on the existing SQL query. This vulnerability ...

EUVD-2026-118971

The GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI plugin for WordPress is vulnerable to generic SQL Injection via the 'input. Gravity Forms name-field part, or list-field row' parameter in all versions up to, and including, 8.1.1 due to insufficient...

CVE-2026-121792 GamiPress <= 8.1.1 - Authenticated (Subscriber+) SQL Injection via 'Gravity Forms Name/List Field' Parameter

The GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI plugin for WordPress is vulnerable to generic SQL Injection via the 'input. Gravity Forms name-field part, or list-field row' parameter in all versions up to, and including, 8.1.1 due to insufficient...

CVE-2026-120512 Form Maker by 10Web <= 1.15.50 - Unauthenticated Stored Cross-Site Scripting via Hidden Input Field Value

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wdformelement Hidden Input field, name = user-defined, e.g. hiddenprobe' parameter in all versions up to, and including, 1.15.50 due to insufficien...

CVE-2026-120512

The Form Maker by 10Web WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 1.15.50 . The root cause is insufficient input sanitization and output escaping of the wdform__element parameter (a user-defined hidden input field). Unauthenticated attacke...

CVE-2025-6251: Improper Neutralization of Input During Web Page Generation

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via $item'fieldid' in all versions up to, and including, 1.7.1036 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...