CVE-2026-16091 Overview
CVE-2026-16091 is a Stored Cross-Site Scripting (XSS) vulnerability in the GamiPress WordPress plugin, affecting all versions up to and including 7.9.9.1. The flaw resides in the gamipress_rank shortcode, which fails to properly sanitize user-supplied input and escape output. Authenticated users with contributor-level access or above can inject arbitrary JavaScript into pages rendered by the plugin. Injected scripts execute in the browser of any visitor who loads the affected page, enabling session theft, redirection, or unauthorized administrative actions. The issue is classified under CWE-79.
Critical Impact
Contributor-level attackers can persistently inject JavaScript that runs in every visitor's browser, including site administrators, enabling account takeover on WordPress sites running vulnerable GamiPress versions.
Affected Products
- GamiPress – Gamification plugin for WordPress
- All versions up to and including 7.9.9.1
- WordPress installations exposing the gamipress_rank shortcode to contributor accounts
Discovery Timeline
- 2026-08-01 - CVE-2026-16091 published to the National Vulnerability Database
- 2026-08-03 - Last updated in NVD database
Technical Details for CVE-2026-16091
Vulnerability Analysis
The vulnerability is a stored XSS flaw in the GamiPress plugin's gamipress_rank shortcode handler. The shortcode accepts attributes that flow into rendered HTML without adequate sanitization or output escaping. Because the injected payload is persisted in WordPress post or page content, every subsequent view of the affected page triggers script execution in the visitor's browser context.
Exploitation requires an authenticated account at contributor level or above. WordPress sites that permit contributor registration or that host multiple content authors are at elevated risk. Because the browser executes the injected script under the site's origin, attackers can steal session cookies, perform actions as an authenticated administrator, or pivot to further compromise the WordPress installation.
Root Cause
The root cause is insufficient input sanitization and output escaping in the shortcode rendering path. Relevant code is present in includes/shortcodes/gamipress_rank.php, includes/filters.php, includes/template-functions.php, and templates/rank.php. User-controlled shortcode attributes are concatenated into HTML without functions such as esc_attr() or esc_html() applied consistently to the output.
Attack Vector
An attacker with contributor privileges authors a post or page containing a gamipress_rank shortcode with malicious attribute values. The payload is stored in the WordPress database. When a higher-privileged user or unauthenticated visitor renders the page, the browser parses and executes the injected script. See the Wordfence Vulnerability Analysis and the GamiPress Rank Shortcode source for the vulnerable code paths.
No verified public exploit code is available. The vulnerability mechanism is described in prose based on the vendor source references.
Detection Methods for CVE-2026-16091
Indicators of Compromise
- Presence of [gamipress_rank ...] shortcodes containing <script>, onerror=, onload=, or javascript: payloads in wp_posts content.
- Unexpected outbound requests from visitor browsers to attacker-controlled domains when loading pages rendered by GamiPress.
- New or modified administrator accounts created shortly after contributor-authored content is published.
- Anomalous session cookie exfiltration patterns in web server or WAF logs.
Detection Strategies
- Query the WordPress database for post_content containing the gamipress_rank shortcode combined with HTML event handlers or script tags.
- Deploy a Web Application Firewall (WAF) rule that inspects POST requests to /wp-admin/post.php for script injection patterns in shortcode attributes.
- Review the WordPress audit log for content edits by contributor-level users that introduce GamiPress shortcodes.
Monitoring Recommendations
- Monitor the GamiPress plugin version across all WordPress installations and alert on versions at or below 7.9.9.1.
- Log and review all contributor-level account activity, particularly post revisions containing shortcodes.
- Enable Content Security Policy (CSP) reporting to surface unexpected inline script execution on public pages.
How to Mitigate CVE-2026-16091
Immediate Actions Required
- Update the GamiPress plugin to a version later than 7.9.9.1 as soon as a patched release is published.
- Audit all existing posts and pages containing the gamipress_rank shortcode for injected script content.
- Restrict contributor-level account creation and review existing contributor accounts for legitimacy.
Patch Information
Refer to the GamiPress Code Changeset for the vendor's remediation commit. Apply the corresponding plugin update from the WordPress plugin repository once available. Verify remediation by reviewing the patched shortcode handler for proper use of esc_attr() and esc_html() on all attribute output.
Workarounds
- Temporarily deactivate the GamiPress plugin on production sites until a fixed version is installed.
- Remove or downgrade contributor-level accounts that do not require content authorship.
- Configure a WAF rule to block requests containing script tags or event handlers within gamipress_rank shortcode attributes.
- Enforce a strict Content Security Policy that disallows inline scripts on pages rendered by the plugin.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
