Stored Cross-Site Scripting Vulnerability in GamiPress Plugin for WordPress

CVE-2024-2783

Summary

The GamiPress plugin, a popular gamification tool for WordPress, is susceptible to a Stored Cross-Site Scripting vulnerability. This occurs due to inadequate input sanitization and output escaping of user-supplied attributes in its shortcodes. As a result, authenticated users with contributor-level access or higher can exploit the vulnerability, injecting arbitrary web scripts into pages. These injected scripts execute whenever a user visits the affected pages, posing significant security risks. Website owners are urged to update to the latest version and ensure proper sanitization practices are in place.

References