rubengc Vulnerabilities and Affected Products

Products

GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress11 vulnerabilities
AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress4 vulnerabilities
GamiPress – Button1 vulnerability
GamiPress – Link1 vulnerability

rubengc vulnerability results
Vulnerability	Title and context	CVSS	EPSS	PoCs	Signals	STIX action
CVE-2026-16091MEDIUM	GamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'gamipress_rank' Shortcode The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gamipress_rank' Shortcode in all versions up to, and including, 7.9.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CWE-79Aug 1, 2026	CVSS6.4v3.1	EPSS0.201%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-16090MEDIUM	GamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via gamipress_achievement Shortcode The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'heading_size' Shortcode Attribute in 'gamipress_achievement' in all versions up to, and including, 7.9.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a use… CWE-79Aug 1, 2026	CVSS6.4v3.1	EPSS0.193%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-15730MEDIUM	GamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'heading_size' Shortcode Attribute The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'heading_size' Shortcode Attribute in all versions up to, and including, 7.9.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page… CWE-79Jul 28, 2026	CVSS6.4v3.1	EPSS0.216%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-13450MEDIUM	GamiPress <= 7.9.4 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'access' Parameter The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 7.9.4 via the 'access' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view private GamiPress activity log entries belonging to any user, including badge earnings, points balance changes, and event records from integrated plu… CWE-639Jul 9, 2026	CVSS5.3v3.1	EPSS0.408%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-13812MEDIUM	GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress <= 7.6.1 - Missing Authorization to Authenticated (Subscriber+) Information Exposure The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the gamipress_ajax_get_posts and gamipress_ajax_get_users functions in all versions up to, and including, 7.6.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enumerate users, including their email addresses and to retrieve titles of private posts. CWE-862Jan 6, 2026	CVSS4.3v3.1	EPSS0.175%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-13496HIGH	GamiPress <= 7.3.1 - Unauthenticated SQL Injection via orderby Parameter The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 7.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract se… CWE-89Jan 22, 20251 related artifact	CVSS7.5v3.1	EPSS2.19%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template	STIX
CVE-2024-13499HIGH	GamiPress <= 7.2.1 - Unauthenticated Arbitrary Shortcode Execution via gamipress_do_shortcode() Function The The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution via gamipress_do_shortcode() function in all versions up to, and including, 7.2.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. CWE-94Jan 22, 2025	CVSS7.3v3.1	EPSS0.591%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-13495HIGH	GamiPress <= 7.2.1 - Unauthenticated Arbitrary Shortcode Execution via gamipress_ajax_get_logs Function The The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution via the gamipress_ajax_get_logs() function in all versions up to, and including, 7.2.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. CWE-94Jan 22, 2025	CVSS7.3v3.1	EPSS0.559%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-11036HIGH	GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress <= 7.1.5 - Unauthenticated Arbitrary Shortcode Execution via gamipress_get_user_earnings The The GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution via gamipress_get_user_earnings AJAX action in all versions up to, and including, 7.1.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. CWE-94Nov 19, 2024	CVSS7.3v3.1	EPSS0.712%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-2783MEDIUM	GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress <= 6.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode The GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 6.9.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user a… CWE-79Apr 9, 2024	CVSS6.4v3.1	EPSS0.363%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-1799HIGH	GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress <= 6.8.6 - Authenticated (Contributor+) SQL Injection via Shortcode The GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to SQL Injection via the 'achievement_types' attribute of the gamipress_earnings shortcode in all versions up to, and including, 6.8.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append a… CWE-89Mar 20, 2024	CVSS8.8v3.1	EPSS0.956%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX