CVE-2026-15730

Name of the Vulnerable Software and Affected Versions GamiPress versions prior to 7.9.9.2

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages using the heading size shortcode attribute. These scripts execute when a user visits the affected page. The issue persists because the wp kses post filter only processes the inert shortcode text during the save process, while the malicious HTML is generated by the shortcode handler during rendering, bypassing the initial sanitization.

Recommendations Update GamiPress to version 7.9.9.2 or later. As a temporary mitigation, restrict users with contributor-level access from using shortcodes with the heading size attribute.