Plugin icon

GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress

gamipress

Vulnerabilities:

12

Last Updated:

March 25, 2026

Active Installs:

10000

Published
Title
Fixed in
CVSS
Published
2026-01-05
Title
GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress < 7.6.2 - Missing Authorization to Authenticated (Subscriber+) Information Exposure
Fixed in
Fixed in 7.6.2
CVSS
4.3 (medium)
Published
2025-06-05
Title
GamiPress < 7.4.6 - Authenticated (Administrator+) SQL Injection
Fixed in
Fixed in 7.4.6
CVSS
4.9 (medium)
Published
2025-05-07
Title
GamiPress < 7.3.8 - Authenticated (Contributor+) Local File Inclusion
Fixed in
Fixed in 7.3.8
CVSS
8.8 (high)
Published
2025-01-21
Title
GamiPress < 7.2.2 - Unauthenticated Arbitrary Shortcode Execution via gamipress_do_shortcode() Function
Fixed in
Fixed in 7.2.2
CVSS
7.3 (high)
Published
2025-01-21
Title
GamiPress < 7.2.2 - Unauthenticated Arbitrary Shortcode Execution via gamipress_ajax_get_logs Function
Fixed in
Fixed in 7.2.2
CVSS
7.3 (high)
Published
2025-01-21
Title
GamiPress < 7.3.2 - Unauthenticated SQL Injection via orderby Parameter
Fixed in
Fixed in 7.3.2
CVSS
7.5 (high)
Published
2024-11-18
Title
GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress < 7.1.6 - Unauthenticated Arbitrary Shortcode Execution via gamipress_get_user_earnings
Fixed in
Fixed in 7.1.6
CVSS
7.3 (high)
Published
2024-04-08
Title
GamiPress < 6.8.9 - Broken Access Control
Fixed in
Fixed in 6.8.9
CVSS
3.8 (low)
Published
2024-03-28
Title
GamiPress < 6.8.6 - Cross-Site Request Forgery
Fixed in
Fixed in 6.8.6
CVSS
4.3 (medium)
Published
2024-03-27
Title
GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress < 6.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Fixed in
Fixed in 6.9.1
CVSS
6.4 (medium)
Published
2024-03-19
Title
GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress < 6.8.7 - Authenticated (Contributor+) SQL Injection via Shortcode
Fixed in
Fixed in 6.8.7
CVSS
8.8 (high)
Published
2023-02-14
Title
GamiPress < 2.5.7.1 - Unauthenticated SQLi
Fixed in
Fixed in 2.5.7.1
CVSS
8.6 (high)