Gamipress develops a WordPress gamification plugin with variants addressing user linking and password-reset functionality, components that sit at the intersection of authentication and user-generated content handling. Vulnerabilities affecting the vendor skew toward serious outcomes with an elevated share reaching critical severity and frequently acquiring public exploit code, concentrated across web-application attack classes including cross-site request forgery, code injection, cross-site scripting, and SQL injection that are characteristic of plugin-layer input handling and access control. Defenders tracking this plugin should prioritize timely WordPress environment updates for affected installations; current severity and exploitation figures are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Gamipress over time
Signals from CVEs in this vendor scope (20 CVEs).
20 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2023-24000CRITICAL Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in GamiPress gamipress allows SQL Injection.This issue affects GamiPress: from n/ | Oct 31, 2023 | 9.8 | 40 | NO | YES |
CVE-2024-13496HIGH The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ par | Jan 22, 2025 | 7.5 | 34 | NO | YES |
CVE-2026-48874HIGH Subscriber SQL Injection in GamiPress <= 7.8.7 versions. | Jun 15, 2026 | 8.5 | 31 | NO | NO |
CVE-2024-11036CRITICAL The The GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution via g | Nov 19, 2024 | 9.8 | 30 | NO | NO |
CVE-2024-1799HIGH The GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to SQL Injection via the 'achievement_type | Mar 20, 2024 | 8.8 | 25 | NO | NO |
CVE-2024-13499HIGH The The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution via gamipres | Jan 22, 2025 | 7.3 | 22 | NO | NO |
CVE-2024-13495HIGH The The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution via the gami | Jan 22, 2025 | 7.3 | 22 | NO | NO |
CVE-2024-2505HIGH The GamiPress WordPress plugin before 6.8.9's access control mechanism fails to properly restrict access to its settings, permitting Authors to manipulate requests and extend acce | Apr 29, 2024 | 8.1 | 22 | NO | NO |
CVE-2026-24546MEDIUM Missing Authorization vulnerability in Ruben Garcia GamiPress allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects GamiPress: from n/a throu | May 25, 2026 | 5.3 | 21 | NO | NO |
CVE-2023-25715MEDIUM Missing Authorization vulnerability in GamiPress GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress.This issue affects GamiPress – T | Dec 19, 2023 | 6.5 | 21 | NO | NO |
Signals from CVEs in this vendor scope (20 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Gamipress.
Media articles that mention a CVE ID that affects a product developed by Gamipress — matched by CVE ID, not by vendor name.