GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress

Information

Software Type Plugin
Software Slug gamipress (view on wordpress.org)
Software Status Active
Software Author rubengc
Software Website gamipress.com
Software Downloads 1,818,297
Software Active Installs 10,000
Software Record Last Updated August 8, 2026

Showing 1-20 of 23 Vulnerabilities

Submit a Vulnerability
GamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via gamipress_achievement Shortcode
6.4
CVE-2026-16090
Jul 31, 2026
Researcher: Wordfence PRISM
GamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'gamipress_rank' Shortcode
6.4
CVE-2026-16091
Jul 31, 2026
Researcher: Wordfence PRISM
GamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'heading_size' Shortcode Attribute
6.4
CVE-2026-15730
Jul 27, 2026
Researcher: Wordfence PRISM
GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress <= 7.9.7 - Unauthenticated SQL Injection
7.5
CVE-2026-59538
Jul 23, 2026
Researcher: qdtad
GamiPress <= 7.9.4 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'access' Parameter
5.3
CVE-2026-13450
Jul 8, 2026
Researcher: Niv Kochan
GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress <= 7.8.7 - Authenticated (Subscriber+) SQL Injection
6.5
CVE-2026-48874
Jun 2, 2026
Researcher: kai63001
GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress <= 7.6.3 - Missing Authorization
5.3
CVE-2026-24546
May 25, 2026
Researcher: bosz
GamiPress <= 7.6.6 - Cross-Site Request Forgery
4.3
CVE-2026-32420
Feb 26, 2026
Researcher: LAKSHMIKANTHAN K (letchupkt)
GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress <= 7.6.1 - Missing Authorization to Authenticated (Subscriber+) Information Exposure
4.3
CVE-2025-13812
Jan 5, 2026
Researcher: kr0d
GamiPress <= 7.4.5 - Authenticated (Administrator+) SQL Injection
4.9
CVE-2025-49326
Jun 5, 2025
Researcher: Nguyen Kim Sang
GamiPress <= 7.3.7 - Authenticated (Contributor+) Local File Inclusion
8.8
CVE-2025-47508
May 7, 2025
Researcher: Muhammad Yudha - DJ
GamiPress <= 7.2.1 - Unauthenticated Arbitrary Shortcode Execution via gamipress_do_shortcode() Function
7.3
CVE-2024-13499
Jan 21, 2025
Researcher: abrahack
GamiPress <= 7.2.1 - Unauthenticated Arbitrary Shortcode Execution via gamipress_ajax_get_logs Function
7.3
CVE-2024-13495
Jan 21, 2025
Researcher: mikemyers
GamiPress <= 7.3.1 - Unauthenticated SQL Injection via orderby Parameter
7.5
CVE-2024-13496
Jan 21, 2025
Researcher: abrahack
GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress <= 7.1.5 - Unauthenticated Arbitrary Shortcode Execution via gamipress_get_user_earnings
7.3
CVE-2024-11036
Nov 18, 2024
Researcher: Arkadiusz Hydzik
GamiPress <= 6.8.8 - Broken Access Control
4.3
CVE-2024-2505
Apr 8, 2024
Researcher: cyc707
GamiPress <= 6.8.5 - Cross-Site Request Forgery
4.3
CVE-2024-30455
Mar 28, 2024
Researcher: Ananda Dhakal
GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress <= 6.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
6.4
CVE-2024-2783
Mar 27, 2024
Researcher: Krzysztof Zając
GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress <= 6.8.6 - Authenticated (Contributor+) SQL Injection via Shortcode
8.8
CVE-2024-1799
Mar 19, 2024
Researcher: Krzysztof Zając
GamiPress <= 2.5.7 - Unauthenticated SQL Injection
9.8
CVE-2023-24000
Feb 14, 2023
Researcher: Dave Jong
Title Status CVE ID CVSS Researchers Date
GamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via gamipress_achievement Shortcode Patched CVE-2026-16090 6.4 Wordfence PRISM July 31, 2026
GamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'gamipress_rank' Shortcode Patched CVE-2026-16091 6.4 Wordfence PRISM July 31, 2026
GamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'heading_size' Shortcode Attribute Patched CVE-2026-15730 6.4 Wordfence PRISM July 27, 2026
GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress <= 7.9.7 - Unauthenticated SQL Injection Patched CVE-2026-59538 7.5 qdtad July 23, 2026
GamiPress <= 7.9.4 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'access' Parameter Patched CVE-2026-13450 5.3 Niv Kochan July 8, 2026
GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress <= 7.8.7 - Authenticated (Subscriber+) SQL Injection Patched CVE-2026-48874 6.5 kai63001 June 2, 2026
GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress <= 7.6.3 - Missing Authorization Patched CVE-2026-24546 5.3 bosz May 25, 2026
GamiPress <= 7.6.6 - Cross-Site Request Forgery Patched CVE-2026-32420 4.3 LAKSHMIKANTHAN K (letchupkt) February 26, 2026
GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress <= 7.6.1 - Missing Authorization to Authenticated (Subscriber+) Information Exposure Patched CVE-2025-13812 4.3 kr0d January 5, 2026
GamiPress <= 7.4.5 - Authenticated (Administrator+) SQL Injection Patched CVE-2025-49326 4.9 Nguyen Kim Sang June 5, 2025
GamiPress <= 7.3.7 - Authenticated (Contributor+) Local File Inclusion Patched CVE-2025-47508 8.8 Muhammad Yudha - DJ May 7, 2025
GamiPress <= 7.2.1 - Unauthenticated Arbitrary Shortcode Execution via gamipress_do_shortcode() Function Patched CVE-2024-13499 7.3 abrahack January 21, 2025
GamiPress <= 7.2.1 - Unauthenticated Arbitrary Shortcode Execution via gamipress_ajax_get_logs Function Patched CVE-2024-13495 7.3 mikemyers January 21, 2025
GamiPress <= 7.3.1 - Unauthenticated SQL Injection via orderby Parameter Patched CVE-2024-13496 7.5 abrahack January 21, 2025
GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress <= 7.1.5 - Unauthenticated Arbitrary Shortcode Execution via gamipress_get_user_earnings Patched CVE-2024-11036 7.3 Arkadiusz Hydzik November 18, 2024
GamiPress <= 6.8.8 - Broken Access Control Patched CVE-2024-2505 4.3 cyc707 April 8, 2024
GamiPress <= 6.8.5 - Cross-Site Request Forgery Patched CVE-2024-30455 4.3 Ananda Dhakal March 28, 2024
GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress <= 6.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Patched CVE-2024-2783 6.4 Krzysztof Zając March 27, 2024
GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress <= 6.8.6 - Authenticated (Contributor+) SQL Injection via Shortcode Patched CVE-2024-1799 8.8 Krzysztof Zając March 19, 2024
GamiPress <= 2.5.7 - Unauthenticated SQL Injection Patched CVE-2023-24000 9.8 Dave Jong February 14, 2023

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation