CVE-2026-14379 Overview
CVE-2026-14379 is a Stored Cross-Site Scripting (XSS) vulnerability in the GamiPress gamification plugin for WordPress. The flaw affects all versions up to and including 7.9.4. It stems from insufficient input sanitization and output escaping on the video_id parameter within the plugin's YouTube integration.
Authenticated attackers with subscriber-level access or above can inject arbitrary JavaScript that executes when any user views an affected page. The vulnerability is tracked under CWE-79 and was published by Wordfence.
Critical Impact
Low-privileged WordPress users can inject persistent scripts that execute in the browser of any site visitor, including administrators, enabling session theft and account takeover.
Affected Products
- GamiPress plugin for WordPress, all versions up to and including 7.9.4
- GamiPress YouTube integration component (integrations/youtube/includes/listeners.php and triggers.php)
- WordPress sites allowing subscriber-level registration with GamiPress installed
Discovery Timeline
- 2026-10-10 - CVE-2026-14379 published to NVD
- 2026-10-13 - Last updated in NVD database
Technical Details for CVE-2026-14379
Vulnerability Analysis
The vulnerability resides in the GamiPress YouTube integration, specifically in the handling of the video_id parameter. The plugin accepts user-supplied input through this parameter without applying adequate sanitization before storing it. When the stored data is later rendered within a WordPress page, the plugin fails to escape output, allowing injected HTML and JavaScript to execute in the viewer's browser.
Because the payload is persisted server-side, every visitor to an affected page triggers execution. The scope change in the vulnerability indicates that injected scripts can affect resources beyond the vulnerable component itself, including the WordPress administrative interface. See the GamiPress listeners source and triggers source for the fixed code paths.
Root Cause
The root cause is a dual failure in secure input handling. The plugin neither sanitizes the video_id parameter on input nor escapes it on output. WordPress provides sanitize_text_field() and esc_attr() / esc_html() helpers for this purpose, but the vulnerable code paths bypass them. This classifies the issue as CWE-79: Improper Neutralization of Input During Web Page Generation.
Attack Vector
An attacker first registers or authenticates to the WordPress site at subscriber level or higher. The attacker then submits a crafted video_id value containing JavaScript payload markup to a GamiPress YouTube integration endpoint. The payload is stored in the database and executes whenever a user, including administrators, loads the affected page. Successful exploitation can hijack sessions, perform actions as the victim, or redirect users to attacker-controlled infrastructure.
No public proof-of-concept or exploit code is currently available for this vulnerability. For technical details, refer to the Wordfence vulnerability report.
Detection Methods for CVE-2026-14379
Indicators of Compromise
- Unexpected <script>, onerror=, or onload= strings in GamiPress-related post meta or options tables
- video_id parameter values containing HTML tags, URL-encoded script content, or JavaScript event handlers
- New or modified GamiPress achievement, trigger, or listener records created by subscriber-level accounts
- Outbound requests from administrator browsers to unfamiliar domains after visiting GamiPress pages
Detection Strategies
- Query the wp_postmeta and wp_options tables for GamiPress keys containing suspicious HTML or JavaScript tokens
- Review web server logs for POST requests to GamiPress endpoints from low-privilege accounts containing script markers in video_id
- Enable WordPress audit logging to track content changes made by subscriber-level users
- Deploy a web application firewall rule to flag script-like payloads in GamiPress parameters
Monitoring Recommendations
- Monitor GamiPress plugin version across all managed WordPress installations and alert on versions at or below 7.9.4
- Track new subscriber account registrations followed by GamiPress API activity
- Alert on administrator sessions generating anomalous outbound requests shortly after accessing gamification pages
- Centralize WordPress and web server logs in a SIEM to correlate authentication, parameter submission, and page rendering events
How to Mitigate CVE-2026-14379
Immediate Actions Required
- Upgrade the GamiPress plugin to version 7.9.5 or later on all WordPress installations
- Audit existing GamiPress stored data for injected scripts and purge malicious entries
- Review and reset credentials for any administrator account that may have viewed affected pages
- Restrict open user registration if subscriber-level accounts are not required for site functionality
Patch Information
The vendor addressed this issue in GamiPress 7.9.5. The fix adds input sanitization and output escaping on the video_id parameter across the YouTube integration. Review the patched sources: listeners.php and triggers.php.
Workarounds
- Disable the GamiPress YouTube integration until the plugin can be upgraded
- Deploy a WordPress security plugin or WAF ruleset that blocks script tags in GamiPress request parameters
- Temporarily disable new user registration or require administrator approval for subscriber accounts
- Apply a Content Security Policy (CSP) header restricting inline script execution to limit XSS impact
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
