Plugin icon

GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI

gamipress

Vulnerabilities:

27

Last Updated:

October 16, 2026

Active Installs:

10000

Published
Title
Fixed in
CVSS
Published
2026-10-12
Title
GamiPress < 8.0.6 - Subscriber+ Activity Log Disclosure
Fixed in
Fixed in 8.0.6
CVSS
4.3 (medium)
Published
2026-10-12
Title
GamiPress < 8.0.6 - Subscriber+ Own Points Balance and Rank Modification
Fixed in
Fixed in 8.0.6
CVSS
4.3 (medium)
Published
2026-10-12
Title
GamiPress 7.9.5 - 8.0.5 - Unauthenticated Private Activity Log Disclosure
Fixed in
Fixed in 8.0.6
CVSS
5.3 (medium)
Published
2026-10-09
Title
GamiPress < 7.9.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'video_id' Parameter
Fixed in
Fixed in 7.9.5
CVSS
6.4 (medium)
Published
2026-09-25
Title
GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI < 8.0.3 - Unauthenticated SQL Injection
Fixed in
Fixed in 8.0.3
CVSS
7.5 (high)
Published
2026-09-10
Title
GamiPress < 7.9.8 - Authenticated (Subscriber+) SQL Injection
Fixed in
Fixed in 7.9.8
CVSS
6.5 (medium)
Published
2026-08-31
Title
GamiPress < 7.9.9.6 - Subscriber+ Arbitrary User Points and Achievement Award via Watch-Video Listeners
Fixed in
Fixed in 7.9.9.6
CVSS
4.3 (medium)
Published
2026-07-31
Title
GamiPress < 7.9.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via gamipress_achievement Shortcode
Fixed in
Fixed in 7.9.9.2
CVSS
5.5 (medium)
Published
2026-07-31
Title
GamiPress < 7.9.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'gamipress_rank' Shortcode
Fixed in
Fixed in 7.9.9.2
CVSS
5.5 (medium)
Published
2026-07-27
Title
GamiPress < 7.9.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'heading_size' Shortcode Attribute
Fixed in
Fixed in 7.9.9.2
CVSS
5.5 (medium)
Published
2026-07-23
Title
GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress < 7.9.8 - Unauthenticated SQL Injection
Fixed in
Fixed in 7.9.8
CVSS
7.5 (high)
Published
2026-07-08
Title
GamiPress < 7.9.5 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'access' Parameter
Fixed in
Fixed in 7.9.5
CVSS
5.3 (medium)
Published
2026-06-02
Title
GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress < 7.8.8 - Authenticated (Subscriber+) SQL Injection
Fixed in
Fixed in 7.8.8
CVSS
6.5 (medium)
Published
2026-05-25
Title
GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress < 7.6.4 - Missing Authorization
Fixed in
Fixed in 7.6.4
CVSS
5.3 (medium)
Published
2026-02-26
Title
GamiPress < 7.6.7 - Cross-Site Request Forgery
Fixed in
Fixed in 7.6.7
CVSS
4.3 (medium)
Published
2026-01-05
Title
GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress < 7.6.2 - Missing Authorization to Authenticated (Subscriber+) Information Exposure
Fixed in
Fixed in 7.6.2
CVSS
4.3 (medium)
Published
2025-06-05
Title
GamiPress < 7.4.6 - Authenticated (Administrator+) SQL Injection
Fixed in
Fixed in 7.4.6
CVSS
4.9 (medium)
Published
2025-05-07
Title
GamiPress < 7.3.8 - Authenticated (Contributor+) Local File Inclusion
Fixed in
Fixed in 7.3.8
CVSS
8.8 (high)
Published
2025-01-21
Title
GamiPress < 7.2.2 - Unauthenticated Arbitrary Shortcode Execution via gamipress_do_shortcode() Function
Fixed in
Fixed in 7.2.2
CVSS
7.3 (high)
Published
2025-01-21
Title
GamiPress < 7.2.2 - Unauthenticated Arbitrary Shortcode Execution via gamipress_ajax_get_logs Function
Fixed in
Fixed in 7.2.2
CVSS
7.3 (high)
Published
2025-01-21
Title
GamiPress < 7.3.2 - Unauthenticated SQL Injection via orderby Parameter
Fixed in
Fixed in 7.3.2
CVSS
7.5 (high)
Published
2024-11-18
Title
GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress < 7.1.6 - Unauthenticated Arbitrary Shortcode Execution via gamipress_get_user_earnings
Fixed in
Fixed in 7.1.6
CVSS
7.3 (high)
Published
2024-04-08
Title
GamiPress < 6.8.9 - Broken Access Control
Fixed in
Fixed in 6.8.9
CVSS
3.8 (low)
Published
2024-03-28
Title
GamiPress < 6.8.6 - Cross-Site Request Forgery
Fixed in
Fixed in 6.8.6
CVSS
4.3 (medium)
Published
2024-03-27
Title
GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress < 6.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Fixed in
Fixed in 6.9.1
CVSS
6.4 (medium)
Published
2024-03-19
Title
GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress < 6.8.7 - Authenticated (Contributor+) SQL Injection via Shortcode
Fixed in
Fixed in 6.8.7
CVSS
8.8 (high)
Published
2023-02-14
Title
GamiPress < 2.5.7.1 - Unauthenticated SQLi
Fixed in
Fixed in 2.5.7.1
CVSS
8.6 (high)