WordPress plugin
GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 31 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical1
- High8
- Medium22
- Low0
All GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI vulnerabilities
- Medium6.5Authenticated (Subscriber+) SQL Injection via 'Gravity Forms Name/List Field' Parameter
≤8.1.1Update to 8.1.2
- Medium6.5Authenticated (Subscriber+) SQL Injection
≤8.0.7Update to 8.0.8
- Medium5.38.0.5 - Missing Authorization
7.9.5 – 8.0.5Update to 8.0.6
- Medium4.3Missing Authorization
<8.0.6Update to 8.0.6
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'video_id' Parameter
≤7.9.4Update to 7.9.5
- High7.5Unauthenticated SQL Injection
≤8.0.2Update to 8.0.3
- Medium6.5Authenticated (Subscriber+) SQL Injection
≤7.9.7Update to 7.9.8
- Medium4.3Missing Authorization
<7.9.9.6Update to 7.9.9.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via gamipress_achievement Shortcode
≤7.9.9.1Update to 7.9.9.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'gamipress_rank' Shortcode
≤7.9.9.1Update to 7.9.9.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'heading_size' Shortcode Attribute
≤7.9.9.1Update to 7.9.9.2
- High7.5Unauthenticated SQL Injection
≤7.9.7Update to 7.9.8
- Medium5.3Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'access' Parameter
≤7.9.4Update to 7.9.5
- Medium6.5Authenticated (Subscriber+) SQL Injection
≤7.8.7Update to 7.8.8
- Medium5.3Missing Authorization
≤7.6.3Update to 7.6.4
- Medium4.3Cross-Site Request Forgery
≤7.6.6Update to 7.6.7
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Information Exposure
≤7.6.1Update to 7.6.2
- Medium4.9Authenticated (Administrator+) SQL Injection
≤7.4.5Update to 7.4.6
- High8.8Authenticated (Contributor+) Local File Inclusion
≤7.3.7Update to 7.3.8
- High7.3Unauthenticated Arbitrary Shortcode Execution via gamipress_do_shortcode() Function
≤7.2.1Update to 7.2.2
- High7.3Unauthenticated Arbitrary Shortcode Execution via gamipress_ajax_get_logs Function
≤7.2.1Update to 7.2.2
- High7.5Unauthenticated SQL Injection via orderby Parameter
≤7.3.1Update to 7.3.2
- High7.3Unauthenticated Arbitrary Shortcode Execution via gamipress_get_user_earnings
≤7.1.5Update to 7.1.6
- Medium4.3Broken Access Control
≤6.8.8Update to 6.8.9
- Medium4.3Cross-Site Request Forgery
≤6.8.5Update to 6.8.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
≤6.9.0Update to 6.9.1
- High8.8Authenticated (Contributor+) SQL Injection via Shortcode
≤6.8.6Update to 6.8.7
- Medium4.3Cross-Site Request Forgery to User Earnings Deletion
≤2.5.6Update to 2.5.7
- Critical9.8Unauthenticated SQL Injection
≤2.5.7Update to 2.5.7.1
- Medium4.3Missing Authorization to User Points Updates
≤2.5.6Update to 2.5.7
- Medium5.4Cross-Site Request Forgery
≤2.5.0Update to 2.5.1
GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI: common questions
Does GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI have known vulnerabilities?
Yes. VulnCrest Radar lists 31 known vulnerabilities in GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI: 1 critical, 8 high, 22 medium. None are known to affect version null.
How do I check which version of GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI vulnerability?
CVE-2026-121792, published Nov 6, 2026: GamiPress <= 8.1.1 - Authenticated (Subscriber+) SQL Injection via 'Gravity Forms Name/List Field' Parameter. Severity: Medium (CVSS 6.5).
Is any GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI vulnerability listed in CISA KEV?
No. None of the known GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI vulnerabilities is currently listed in the CISA KEV catalog.