CVE-2026-14379

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'videoid' parameter in all versions up to, and including, 7.9.4 due to insufficient input sanitization and output escaping. Thi...

EUVD-2026-96094

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'videoid' parameter in all versions up to, and including, 7.9.4 due to insufficient input sanitization and output escaping. Thi...

CVE-2026-14379

The GamiPress – Gamification plugin for WordPress (versions up to and including 7.9.4 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping associated with the 'video_id' parameter . This flaw allows authenticated attackers wi...

CVE-2026-14379 GamiPress <= 7.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'video_id' Parameter

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'videoid' parameter in all versions up to, and including, 7.9.4 due to insufficient input sanitization and output escaping. Thi...

CVE-2026-14379: Improper Neutralization of Input During Web Page Generation

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'videoid' parameter in all versions up to, and including, 7.9.4 due to insufficient input sanitization and output escaping. Thi...

CVE-2025-2484: Improper Neutralization of Input During Web Page Generation

The Multi Video Box plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'videoid' and 'groupid' parameters in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

WordPress Users Ultra Plugin 1.5.50 - Blind SQL 注入

在users-ultra插件的xooclasses/xoo.userultra.photos.php文件中有如下代码： public function editvideoconfirm global $wpdb, $xoouserultra; requireonceABSPATH . 'wp-includes/formatting.php'; $userid = getcurrentuserid; $videoid = $POST"videoid"; //videoid 直接从POST取值 $videoname = sanitizetextfield$POST"videoname";...