CVE-2026-15730 in GamiPress Plugin
Summary
by MITRE • 07/28/2026
The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'heading_size' Shortcode Attribute in all versions up to, and including, 7.9.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The wp_kses_post filter applied at post save does not neutralize this payload because only the inert shortcode text is stored in post_content; the dangerous HTML is synthesized at render time by the shortcode handler, entirely bypassing save-time sanitization.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/28/2026
The GamiPress plugin represents a popular gamification solution for wordpress platforms enabling administrators to reward users with points, achievements, badges, and ranks through various interactive elements. This particular vulnerability exists within the plugin's handling of the heading_size shortcode attribute, affecting all versions up to and including 7.9.9.1. The flaw constitutes a stored cross-site scripting vulnerability that specifically targets authenticated attackers who possess contributor-level access or higher privileges within the wordpress environment.
The technical root cause stems from inadequate input sanitization and output escaping mechanisms within the plugin's shortcode processing logic. When administrators or users with sufficient privileges create content containing the heading_size shortcode attribute, the malicious payload gets stored in the wordpress database as part of the post_content field. However, the vulnerability manifests during the rendering phase rather than storage, where the shortcode handler dynamically generates HTML content based on user input without proper sanitization measures. This architectural design flaw means that while wp_kses_post filter is applied during post saving, it only processes the static shortcode text and fails to neutralize potentially dangerous HTML elements that are created dynamically during page rendering.
The operational impact of this vulnerability extends beyond simple script execution as it allows attackers with contributor privileges to compromise user sessions and potentially escalate their access within the wordpress environment. When any authenticated user visits a page containing the maliciously injected shortcode, the stored scripts execute automatically in their browser context, creating opportunities for session hijacking, credential theft, or further exploitation of the compromised wordpress installation. This vulnerability particularly affects environments where multiple users with contributor roles exist, as it provides a persistent attack vector that can remain undetected until exploited by an attacker who has gained sufficient privileges.
Security practitioners should recognize this issue as aligning with common weakness enumerations such as CWE-79 (Cross-Site Scripting) and potentially CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page). The vulnerability also maps to attack techniques within the mitre att&ck framework under initial access and privilege escalation categories, particularly where attackers leverage weak input validation to inject malicious code into persistent storage. Organizations should implement immediate mitigations including upgrading to patched plugin versions, implementing strict content filtering policies, and monitoring user-generated content for suspicious shortcode usage patterns.
Mitigation strategies must address both the immediate vulnerability and broader security posture considerations. The primary recommendation involves updating to the latest plugin version where the heading_size attribute sanitization has been properly implemented. Additionally, administrators should consider implementing custom wp_kses filters that specifically target and neutralize dangerous attributes within shortcode processing. Network monitoring solutions should be configured to detect unusual shortcode usage patterns or attempts to inject malicious payloads through contributor-level access points. Regular security audits of user permissions and content moderation practices can help identify potential exploitation vectors before they are successfully leveraged, while also ensuring that the wp_kses_post filter operates consistently across all content types within the wordpress installation.