CVE-2026-16090: GamiPress WordPress Plugin XSS Vulnerability

CVE-2026-16090 Overview

CVE-2026-16090 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the GamiPress WordPress plugin. The flaw affects all versions of GamiPress up to and including 7.9.9.1. It resides in the heading_size attribute of the gamipress_achievement shortcode. Authenticated attackers with contributor-level access or higher can inject arbitrary JavaScript into pages. The injected script executes in the browser of any user who views the affected page.

Critical Impact

Contributor-level accounts can persist JavaScript that executes against every visitor of an injected page, enabling session theft, forced actions, and privilege escalation against site administrators.

Affected Products

• GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress
• All versions up to and including 7.9.9.1
• WordPress installations with contributor-or-higher accounts exposed to untrusted users

Discovery Timeline

• 2026-08-01 - CVE-2026-16090 published to NVD
• 2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-16090

Vulnerability Analysis

GamiPress registers the gamipress_achievement shortcode, which accepts a heading_size attribute intended to specify an HTML heading tag. The plugin fails to validate or escape this attribute before emitting it into the rendered HTML. A contributor who embeds the shortcode with a crafted heading_size value can inject arbitrary attributes and script content into the output.

The vulnerable code paths are documented in the plugin source at includes/filters.php line 542 and includes/shortcodes/gamipress_achievement.php line 229. Because the payload is stored inside post content as a shortcode attribute, WordPress's save-time filter wp_kses_post does not strip it. The dangerous value only materializes as executable HTML at render time.

Root Cause

The root cause is insufficient input sanitization and missing output escaping on the heading_size shortcode attribute. The plugin concatenates the attribute value into an HTML tag without calling esc_attr() or restricting the value to a fixed allowlist such as h1 through h6. Standard WordPress content filtering runs against raw HTML tags, not against shortcode attribute strings held inside post content, so the payload passes through storage untouched.

Attack Vector

An attacker requires an authenticated account with contributor privileges or higher. The attacker creates or edits a post containing the gamipress_achievement shortcode and supplies a malicious heading_size value that breaks out of the attribute context to inject a script tag or event handler. Once the post is published or previewed, the payload executes in the context of every viewer, including administrators. This enables session hijacking, administrative action forgery, and further site compromise.

See the Wordfence Vulnerability Report and the WordPress GamiPress Shortcodes Code for technical details.

Detection Methods for CVE-2026-16090

Indicators of Compromise

• Post or page content containing gamipress_achievement shortcodes with heading_size values that include characters such as <, >, ", ', or on event handler prefixes.
• Unexpected <script> tags or inline JavaScript rendered in pages that use GamiPress shortcodes.
• Contributor or author accounts creating or editing posts that embed the gamipress_achievement shortcode outside of normal workflow.
• Outbound requests from visitor browsers to unknown domains after loading a GamiPress-rendered page.

Detection Strategies

• Query the wp_posts table for post_content matching the pattern gamipress_achievement combined with heading_size= and inspect the attribute values for HTML metacharacters.
• Enable HTTP response inspection at the web application firewall to flag scripts injected into pages that call GamiPress shortcodes.
• Review WordPress audit logs for post edits by low-privilege roles that add or modify GamiPress shortcodes.

Monitoring Recommendations

• Monitor content-editing activity by contributor and author roles and alert on shortcode modifications.
• Deploy Content Security Policy headers in report-only mode to surface script executions from unexpected inline sources.
• Track plugin version inventory and alert when any WordPress site continues to run GamiPress at or below 7.9.9.1.

How to Mitigate CVE-2026-16090

Immediate Actions Required

• Update the GamiPress plugin to a version above 7.9.9.1 on all WordPress installations that use it.
• Audit existing posts and pages for gamipress_achievement shortcodes containing suspicious heading_size attribute values and remove any injected payloads.
• Restrict contributor, author, and editor accounts to trusted users and rotate credentials for accounts that were shared or exposed.
• Force session invalidation for administrators who may have viewed a compromised page since the plugin was installed.

Patch Information

The vendor addressed the issue in a subsequent release. The corresponding source change is documented in the WordPress GamiPress Changeset. Review the WordPress GamiPress Filters Code reference to confirm the fixed function paths against the deployed version.

Workarounds

• Temporarily deactivate the GamiPress plugin until the site is updated to a patched release.
• Remove or restrict use of the gamipress_achievement shortcode through a must-use plugin that strips it before rendering.
• Deploy a web application firewall rule that blocks POST requests containing heading_size values with HTML metacharacters in shortcode context.
• Apply a strict Content Security Policy that disallows inline scripts on pages rendered by GamiPress.

# Configuration example: block risky heading_size values via WAF regex
# ModSecurity rule to reject requests injecting HTML into the shortcode attribute
SecRule ARGS "@rx heading_size\s*=\s*[\"'][^\"']*[<>\"'][^\"']*[\"']" \
    "id:1026160901,phase:2,deny,status:403,log,\
    msg:'CVE-2026-16090 GamiPress heading_size XSS attempt'"