CVE-2026-14379: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in rubengc GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI

CVE-2026-14379 is a stored cross-site scripting vulnerability in the GamiPress – Gamification plugin for WordPress, affecting versions up to 7.9.4. The flaw exists in the handling of the 'video_id' parameter, where insufficient sanitization and escaping allow authenticated users with subscriber-level privileges or higher to inject arbitrary web scripts. These scripts execute in the context of users who access the injected pages, potentially leading to session hijacking or other script-based attacks. The CVSS 3.1 base score is 6.4, indicating a medium severity with network attack vector, low attack complexity, and requiring privileges but no user interaction.

An attacker with subscriber-level access or higher can exploit this vulnerability to inject and execute arbitrary scripts in the context of other users visiting the affected pages. This can lead to information disclosure or session hijacking. The vulnerability does not impact availability but compromises confidentiality and integrity to a limited extent.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory for updates. Until a fix is released, consider restricting subscriber-level user capabilities or applying custom input validation and output escaping as a temporary mitigation.