https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 16:28:24 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-16090 <p>The GamiPress – Gamification plugin to reward points, achievements, badges &amp; ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via &#39;heading_size&#39; Shortcode Attribute in &#39;gamipress_achievement&#39; in all versions up to, and including, 7.9.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. WordPress save-time wp_kses_post does not neutralize this payload because the injected value is stored inside a shortcode attribute rather than as a raw HTML tag, and is only emitted into HTML at render time without escaping.</p> <p>The GamiPress – Gamification plugin to reward points, achievements, badges &amp; ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via &#39;heading_size&#39; Shortcode Attribute in &#39;gamipress_achievement&#39; in all versions up to, and including, 7.9.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. WordPress save-time wp_kses_post does not neutralize this payload because the injected value is stored inside a shortcode attribute rather than as a raw HTML tag, and is only emitted into HTML at render time without escaping.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-16090 https://vulnerability.circl.lu/vuln/ghsa-vqxc-cxjv-jp2h <p>The GamiPress – Gamification plugin to reward points, achievements, badges &amp; ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via &#39;heading_size&#39; Shortcode Attribute in &#39;gamipress_achievement&#39; in all versions up to, and including, 7.9.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. WordPress save-time wp_kses_post does not neutralize this payload because the injected value is stored inside a shortcode attribute rather than as a raw HTML tag, and is only emitted into HTML at render time without escaping.</p> <p>The GamiPress – Gamification plugin to reward points, achievements, badges &amp; ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via &#39;heading_size&#39; Shortcode Attribute in &#39;gamipress_achievement&#39; in all versions up to, and including, 7.9.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. WordPress save-time wp_kses_post does not neutralize this payload because the injected value is stored inside a shortcode attribute rather than as a raw HTML tag, and is only emitted into HTML at render time without escaping.</p> https://vulnerability.circl.lu/vuln/ghsa-vqxc-cxjv-jp2h