CVE-2026-15730: GamiPress WordPress Plugin XSS Vulnerability

CVE-2026-15730 Overview

CVE-2026-15730 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the GamiPress WordPress plugin, which provides gamification features such as points, achievements, badges, and ranks. The flaw affects all versions up to and including 7.9.9.1 and stems from insufficient input sanitization and output escaping in the heading_size shortcode attribute. Authenticated attackers with contributor-level access or higher can inject arbitrary JavaScript that executes when other users view an affected page. The wp_kses_post filter applied at post save does not neutralize the payload because only inert shortcode text is stored in post_content; the dangerous HTML is synthesized at render time by the shortcode handler.

Critical Impact

Contributor-level users can inject persistent JavaScript that executes in the browser of any visitor, including administrators, enabling session theft, account takeover, and administrative action forgery.

Affected Products

• GamiPress – Gamification plugin for WordPress
• All versions up to and including 7.9.9.1
• WordPress sites using the vulnerable gamipress_points_types shortcode handler

Discovery Timeline

• 2026-07-28 - CVE-2026-15730 published to NVD
• 2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-15730

Vulnerability Analysis

The vulnerability resides in the GamiPress shortcode rendering pipeline, specifically in the handling of the heading_size attribute processed by gamipress_points_types.php. WordPress applies wp_kses_post at post save time to strip dangerous HTML from post_content. However, GamiPress stores only the raw shortcode text, such as [gamipress_points_types heading_size="..."], at save time. The heading_size attribute value is then interpolated directly into rendered HTML at output, producing an attacker-controlled tag or attribute context without sanitization or escaping.

This save-time versus render-time asymmetry defeats the wp_kses_post control. Any shortcode attribute reflected into HTML during rendering must be independently escaped, and this handler omits that step. The attack requires an authenticated account, but contributor role is the default lowest publishing role on many WordPress installations, keeping the barrier low.

Root Cause

The root cause is missing context-appropriate output escaping in the shortcode handler. Values passed via the heading_size attribute flow into the rendered heading markup without being processed by esc_attr(), esc_html(), or a comparable escaping function. The related filter code paths referenced at lines 263, 390, 542, and 1885 of includes/filters.php compound the issue by transforming shortcode content into HTML at render time.

Attack Vector

An authenticated attacker with contributor privileges or higher creates or edits a post containing a gamipress_points_types shortcode. They set the heading_size attribute to a payload that breaks out of the intended attribute or tag context and injects a <script> block or event handler. Once the post is viewed by another user, the injected script executes with that user's privileges. If an administrator views the post, the script can perform administrative actions such as creating new users, modifying plugin settings, or exfiltrating session cookies.

No exploit code example is provided. See the Wordfence Vulnerability Report and WordPress GamiPress Shortcode Code for the affected code path.

Detection Methods for CVE-2026-15730

Indicators of Compromise

• Posts or pages containing gamipress_points_types shortcodes with heading_size attribute values that include <, >, quote characters, on*= event handlers, or javascript: URIs.
• New administrator accounts, modified user roles, or plugin option changes shortly after a contributor account edited or published content.
• Outbound requests from browser sessions to unfamiliar domains when viewing pages that embed GamiPress shortcodes.

Detection Strategies

• Query the WordPress database for shortcode instances: SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%gamipress_points_types%' AND post_content LIKE '%heading_size=%'; and review each match.
• Monitor web server access logs for suspicious POST requests to /wp-admin/post.php from contributor-role accounts followed by anomalous traffic patterns on the same URLs.
• Deploy a web application firewall rule that inspects rendered responses for <script> tags originating from GamiPress shortcode output.

Monitoring Recommendations

• Audit all posts authored or edited by contributor-level and author-level users, prioritizing those referencing GamiPress shortcodes.
• Alert on WordPress role changes, new administrator account creation, and unexpected modifications to wp_options.
• Track browser telemetry for pages hosting GamiPress content to identify unauthorized script execution or DOM manipulation.

How to Mitigate CVE-2026-15730

Immediate Actions Required

• Update the GamiPress plugin to a version later than 7.9.9.1 as soon as a patched release is available from the plugin repository.
• Audit contributor, author, and editor accounts, disable unused accounts, and enforce strong authentication on remaining accounts.
• Review recent post revisions for gamipress_points_types shortcodes containing suspicious heading_size values and remove or sanitize them.

Patch Information

Refer to the WordPress GamiPress Changeset for the upstream fix. Apply the vendor-supplied update through the WordPress plugin manager or WP-CLI. Confirm the running version exceeds 7.9.9.1 after the update.

Workarounds

• Temporarily deactivate the GamiPress plugin until an updated version is installed if contributor-level publishing cannot be restricted.
• Restrict shortcode usage by removing publishing privileges from untrusted contributor and author accounts, or require editor review before publication.
• Deploy a web application firewall rule that blocks requests containing heading_size attribute values with HTML metacharacters or script keywords.

# Update GamiPress via WP-CLI once a fixed version is released
wp plugin update gamipress
wp plugin get gamipress --field=version

# Identify posts using the vulnerable shortcode attribute
wp db query "SELECT ID, post_title, post_author FROM wp_posts WHERE post_content LIKE '%heading_size=%' AND post_content LIKE '%gamipress_points_types%';"