CVE-2026-16091

Name of the Vulnerable Software and Affected Versions GamiPress versions prior to 7.9.9.2

Description The GamiPress – Gamification plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs due to insufficient input sanitization and output escaping within the gamipress rank shortcode. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages, which then execute when a user visits the affected page.

Recommendations Update the plugin to a version newer than 7.9.9.1. As a temporary mitigation, restrict the use of the gamipress rank shortcode by users with contributor-level access.