303 matches found
WordPress GamiPress <= 2.5.7 - SQL Injection
The GamiPress plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.5.7 due to insufficient escaping on the user supplied parameter '$qv$fieldid' and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to...
GamiPress <= 2.8.9 - SQL Injection
GamiPress WordPress plugin version 2.8.9 and below suffers from an SQL injection vulnerability due to insufficient sanitization of user input, allowing attackers to execute arbitrary SQL commands. id: CVE-2024-13496 info: name: GamiPress = 2.8.9 - SQL Injection author: ritikchaddha severity: high...
CVE-2026-14379
The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'videoid' parameter in all versions up to, and including, 7.9.4 due to insufficient input sanitization and output escaping. Thi...
CVE-2026-14379 GamiPress <= 7.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'video_id' Parameter
The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'videoid' parameter in all versions up to, and including, 7.9.4 due to insufficient input sanitization and output escaping. Thi...
EUVD-2026-96094
The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'videoid' parameter in all versions up to, and including, 7.9.4 due to insufficient input sanitization and output escaping. Thi...
CVE-2026-14379
The GamiPress – Gamification plugin for WordPress (versions up to and including 7.9.4 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping associated with the 'video_id' parameter . This flaw allows authenticated attackers wi...
WordPress GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI plugin <= 7.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability
Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Supakiad S. m3ez in WordPress Plugin GamiPress versions = 7.9.4...
CVE-2026-94177
Unauthenticated SQL Injection in GamiPress = 8.0.2 versions...
CVE-2026-94177
The GamiPress plugin for WordPress, versions
CVE-2026-94177 WordPress GamiPress plugin <= 8.0.2 - SQL Injection vulnerability
Unauthenticated SQL Injection in GamiPress = 8.0.2 versions...
EUVD-2026-89842
Unauthenticated SQL Injection in GamiPress = 8.0.2 versions...
CVE-2026-94177 WordPress GamiPress plugin <= 8.0.2 - SQL Injection vulnerability
Unauthenticated SQL Injection in GamiPress = 8.0.2 versions...
CVE-2026-94177: Improper Neutralization of Special Elements used in an SQL Command
Unauthenticated SQL Injection in GamiPress = 8.0.2 versions...
PT-2026-103174
Unauthenticated SQL Injection in GamiPress = 8.0.2 versions...
WordPress GamiPress plugin <= 8.0.2 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Bruno Alvarenga in WordPress Plugin GamiPress versions = 8.0.2...
CVE-2026-15439
The GamiPress plugin for WordPress is vulnerable to authenticated Subscriber+ SQL Injection via the 'q' parameter of the wpForo integration AJAX selector action gamipresswpforogetposts in versions up to, and including, 7.9.7. The value is passed only through $wpdb-esclike and interpolated directl...
CVE-2026-15439 GamiPress <= 7.9.7 - Authenticated (Subscriber+) SQL Injection
The GamiPress plugin for WordPress is vulnerable to authenticated Subscriber+ SQL Injection via the 'q' parameter of the wpForo integration AJAX selector action gamipresswpforogetposts in versions up to, and including, 7.9.7. The value is passed only through $wpdb-esclike and interpolated directl...
EUVD-2026-76139
The GamiPress plugin for WordPress is vulnerable to authenticated Subscriber+ SQL Injection via the 'q' parameter of the wpForo integration AJAX selector action gamipresswpforogetposts in versions up to, and including, 7.9.7. The value is passed only through $wpdb-esclike and interpolated directl...
CVE-2026-15439
The GamiPress WordPress plugin (versions up to and including 7.9.7 ) is vulnerable to authenticated SQL injection via the q parameter in the wpForo integration AJAX action gamipress_wpforo_get_posts. The input is filtered only by $wpdb->esc_like() and interpolated directly into a single-quoted...
CVE-2026-15439 GamiPress <= 7.9.7 - Authenticated (Subscriber+) SQL Injection
The GamiPress plugin for WordPress is vulnerable to authenticated Subscriber+ SQL Injection via the 'q' parameter of the wpForo integration AJAX selector action gamipresswpforogetposts in versions up to, and including, 7.9.7. The value is passed only through $wpdb-esclike and interpolated directl...