GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI

GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI has 30 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2026; all 30 are fixed as of October 2026. Their average CVSS score is 6.1, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 8 high. 2026 was the busiest year with 16 disclosures.

The most common weakness is SQL Injection, behind 9 of the records (30%). Other recurring categories include Missing Authorization, Cross-Site Scripting.

Every one of the 30 issues recorded for GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI has a vendor fix available, so running the current release closes all known holes.

23 independent researchers contributed these findings, most of them (3) reported by Dave Jong. GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI is installed on roughly 10,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

01234567891020.07.2017Today12.01.20235.4GamiPress <= 2.5.0 - Cross-Site Request Forgery CVSS 5.4 · 12.01.202313.02.20234.3GamiPress <= 2.5.6 - Missing Authorization to User Points Updates CVSS 4.3 · 13.02.202314.02.20239.8GamiPress <= 2.5.7 - Unauthenticated SQL Injection CVSS 9.8 · 14.02.20234.3GamiPress <= 2.5.6 - Cross-Site Request Forgery to User Earnings Deletion CVSS 4.3 · 14.02.202319.03.20248.8GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress <= 6.8.6 - Authenticated (Contributor+) SQL Injection via Shortcode CVSS 8.8 · 19.03.202427.03.20246.4GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress <= 6.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVSS 6.4 · 27.03.202428.03.20244.3GamiPress <= 6.8.5 - Cross-Site Request Forgery CVSS 4.3 · 28.03.202408.04.20244.3GamiPress <= 6.8.8 - Broken Access Control CVSS 4.3 · 08.04.202418.11.20247.3GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress <= 7.1.5 - Unauthenticated Arbitrary Shortcode Execution via gamipress_get_user_earnings CVSS 7.3 · 18.11.202421.01.20257.5GamiPress <= 7.3.1 - Unauthenticated SQL Injection via orderby Parameter CVSS 7.5 · 21.01.20257.3GamiPress <= 7.2.1 - Unauthenticated Arbitrary Shortcode Execution via gamipress_ajax_get_logs Function CVSS 7.3 · 21.01.20257.3GamiPress <= 7.2.1 - Unauthenticated Arbitrary Shortcode Execution via gamipress_do_shortcode() Function CVSS 7.3 · 21.01.202507.05.20258.8GamiPress <= 7.3.7 - Authenticated (Contributor+) Local File Inclusion CVSS 8.8 · 07.05.202505.06.20254.9GamiPress <= 7.4.5 - Authenticated (Administrator+) SQL Injection CVSS 4.9 · 05.06.202505.01.20264.3GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress <= 7.6.1 - Missing Authorization to Authenticated (Subscriber+) Information Exposure CVSS 4.3 · 05.01.202626.02.20264.3GamiPress <= 7.6.6 - Cross-Site Request Forgery CVSS 4.3 · 26.02.202625.05.20265.3GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress <= 7.6.3 - Missing Authorization CVSS 5.3 · 25.05.202602.06.20266.5GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress <= 7.8.7 - Authenticated (Subscriber+) SQL Injection CVSS 6.5 · 02.06.202608.07.20265.3GamiPress <= 7.9.4 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'access' Parameter CVSS 5.3 · 08.07.202623.07.20267.5GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress <= 7.9.7 - Unauthenticated SQL Injection CVSS 7.5 · 23.07.202627.07.20266.4GamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'heading_size' Shortcode Attribute CVSS 6.4 · 27.07.202631.07.20266.4GamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'gamipress_rank' Shortcode CVSS 6.4 · 31.07.20266.4GamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via gamipress_achievement Shortcode CVSS 6.4 · 31.07.202603.09.20264.3GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI < 7.9.9.6 - Missing Authorization CVSS 4.3 · 03.09.202610.09.20266.5GamiPress <= 7.9.7 - Authenticated (Subscriber+) SQL Injection CVSS 6.5 · 10.09.202625.09.20267.5GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI <= 8.0.2 - Unauthenticated SQL Injection CVSS 7.5 · 25.09.202609.10.20266.4GamiPress <= 7.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'video_id' Parameter CVSS 6.4 · 09.10.202614.10.20264.3GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI < 8.0.6 - Missing Authorization CVSS 4.3 · 14.10.20265.3GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI 7.9.5 - 8.0.5 - Missing Authorization CVSS 5.3 · 14.10.202621.10.20266.5GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI <= 8.0.7 - Authenticated (Subscriber+) SQL Injection CVSS 6.5 · 21.10.2026

Strategic Overview

Avg CVSSMedium
6.1/ 10
Patch Coverage100%
Open

0

Fixed

30

Get automatic notifications for all GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2023-24000

GamiPress <= 2.5.7 - Unauthenticated SQL Injection

Read the full analysis

Vulnerability Records

30 records
2026-10-21 00:00CVE-2026-112837
6.5
Medium
leon figueiraYes
2026-10-14 00:00CVE-2026-107319
4.3
Medium
ShirshakYes
2026-10-14 00:00CVE-2026-107320
5.3
Medium
Usama ArshadYes
2026-10-09 16:47CVE-2026-14379
6.4
Medium
Supakiad S. (m3ez)Yes
2026-09-25 00:00CVE-2026-94177
7.5
High
Bruno AlvarengaYes
2026-09-10 14:36CVE-2026-15439
6.5
Medium
Nox AxterYes
2026-09-03 00:00CVE-2026-77764
4.3
Medium
Shivamani VastralaYes
2026-07-31 19:28CVE-2026-16090
6.4
Medium
Wordfence PRISMYes
2026-07-31 19:27CVE-2026-16091
6.4
Medium
Wordfence PRISMYes
2026-07-27 18:18CVE-2026-15730
6.4
Medium
Wordfence PRISMYes
Showing 1–10 of 30 reports
GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI banner
Latestv8.1.0

GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI

Ruben Garcia

Author

Ruben Garcia

4.9(493)
98/100
Last Updated
2026-10-23 (5d ago)
Active Installs
10,000+
Downloads
1,903,613
Requires WP
4.4+
Requires PHP
7.0+
Tested up to
WP 7.1.3
Created
2017-07-20 (9y ago)

Live Demo | Add-ons | Assets | Documentation | Code Snippets GamiPress is the easiest way to gamify your WordPress website in just a few minutes, letting you award your users with digital rewards for interacting with your site. Easily define the achievements, organize requirements, and choose from a range of assessment options to determine whether each task or requirement has been successfully achieved. 💎 3 powerful ways to build your gamification strategy GamiPress combines three of the most powerful award systems you could add to your site: Points to reward your users automatically for interacting with your site. Achievements to award users for meeting all requirements, sequentially or otherwise. Ranks to let users progress through ranks by fulfilling every requirement. 🏅 Unlimited options to reward your users Site interactions (sign-ups, logins, daily visits). Content creation (posts, comments, reviews). Course progress (courses completed, lessons finished, quizzes passed) Store activity (purchases, subscriptions, memberships, lifetime value) Community participation (groups, friendships, forums) Affiliate actions (referrals, inviting friends, sharing links) Gamification unlocks (expending points, unlocking badges, reaching higher ranks) 🔥 Features Unlimited Types: Create unlimited points types (Credits, Gems), achievement types (Badges, Quests) and rank types (Grades, Levels). Automatic points awards and deductions: Easily configure automatic ways to award or deduct points to your users. Custom requirements: Define conditional requirements that users must meet to unlock any achievement or rank. Time limit requirements: Set time-based limits that define how often users can complete a requirement (minutely, hourly, daily, weekly, monthly or yearly). Drag and drop controls: Powerful controls to set up your gamification environment in minutes. Badge Builder: Create fully customizable badge images quickly and effortlessly with our built-in Badge Builder. No design skills required! Social sharing: Users can share the achievements and ranks they have earned on any social network of their choice. Unlock using points: Let users to optionally unlock any achievement or rank by expending an amount of points without meet the requirements. Emails: Your users will get notified automatically about new awards. AI Assistant included: Our AI assistant is ready to help you design, create and manage your gamification strategy in seconds! Open Badges: Connect your site achievements with Badgr or Credly to issue open badges as an official recognition of the skills of your users. Blocks, Shortcodes & Widgets: WordPress-friendly blocks, shortcodes and widgets to show the user points wallet, earned achievements, latest earnings, and more. GDPR Support: Support for WordPress personal data export and deletion tools. 🛠️ Advanced Features Theme Agnostic: GamiPress works with just about any standard WordPress theme. Templates System: Overwritable templates to customize everything you want from GamiPress. Data centralization on Multisite: Centralize all the GamiPress data on multisite. Rest API: Full support to WP Rest API to connect GamiPress with external applications. Developer-friendly: Extremely flexible with plenty of hooks to add custom functionalities. ✨ AI Assistant included! Built-in AI Assistant designed to design, create, and manage your gamification strategy using natural language. Its features include: 🕹️ Design and create your site gamification: Describe your goal(s) and the Assistant will create the entire configuration required, ready for you to review and activate! Plus, the assistant can suggest configurations and create them based on your site setup. Example Prompts: Suggest and create 5 badges based on BuddyBoss activities Create a points type with 3 awards and 2 deductions based on LearnDash activities 🚀 Set Up GamiPress elements in seconds: The Assistant can configure the GamiPress elements of your choice, being able to create new types, configure points types, achievements and ranks in no time! Example Prompt: Create a badge for completing 3 courses and for purchasing "Product A" ✏️ Update existing elements: Additionally, the Assistant can update existing points, achievements and ranks effortlessly. Example Prompts: Add 2 awards based on FluentCRM activities to "Credits" Add a step to "Badge A" for log in 5 times 🏅 Manage user earnings: Made to help you save time, the Assistant can also award, deduct and revoke anything to your users. Example Prompts: Award 10 Credits to John Doe for commenting Revoke "Badge A" to Irene Berna Note: This assistant uses the WP AI Connectors. Without a configured connector, it won’t be able to perform any tasks. ⭐ Add-ons to extend GamiPress WordPress.org is home to some amazing extensions for GamiPress, including: Button & Link LearnDash Group Leaderboard BuddyPress Group Leaderboard Block Users Notifications By Type Multimedia Content Activity by Category View all plugins on wordpress.org If you’re looking for something endorsed and maintained by the developers who built GamiPress, there are a plethora of premium add-ons, the most popular of which include: Leaderboards Notifications Social Share Progress Map Restrict Content Reports & Frontend Reports Daily Login Rewards Time-based Rewards Referrals Transfers Zapier Limited-Time Rewards Monster Collecting Game View all add-ons ⚙️ Integrated with your favorites WordPress plugins GamiPress integrates with a large number of plugins allowing you to add gamification in any environment. 🎓 LMS integrations Boost students motivation and improve completion rates with game-like rewards. LearnDash H5P LearnPress Lifter LMS Tutor LMS Sensei LMS Including Thrive Apprentice, eLearnCommerce, MasterStudy LMS, WP Courseware and WPLMS 🫂 Community integrations Increase participation by rewarding your community members interactions. BuddyBoss BuddyPress bbPress Ultimate Member PeepSo WP User Manager MemberPress Paid Memberships Pro FluentCommunity SureMembers Including ARMember, DigiMember, wpDiscuz, Simple:Press, WishList Member, wpForo and Asgaros Forum 🛒 eCommerce & membership integrations Turn shopping into an interactive experience that drives customer loyalty & bring exclusive rewards to improve your members engagement and retention.. WooCommerce Easy Digital Downloads FluentCart Studiocart Give Restrict Content Pro SureCart Including Download Manager, Paid Membership Subscriptions, Upsell Plugin, WP Simple Pay and WooCommerce Shipstation 📋 Forms integrations Increase form completion and participation by rewarding your users submissions. BBForms Gravity Forms Contact Form 7 Ninja Forms Formidable Forms Forminator FluentForms JetFormBuilder WPForms Thrive Ovation & Thrive Leads Including ARForms, Everest Forms, HappyForms, Kali Forms, weForms, WS Form and MetForm From page builders like Divi, Elementor, Brizy and Kadence Blocks ⭐ Other integrations Gamify your CRM, Affiliate Program, Event Booking, Job Boards even your Support Platform. GamiPress connects with almost any plugin and platform and if it doesn’t, just ask us for it! AutomatorWP ShortLinks Pro AffiliateWP Youtube & Vimeo The Events Calendar Advanced Custom Fields (ACF) Meta Box Presto Player Advanced Ads Amelia AnsPress FunnelKit Automations Awesome Support Easy Affiliate Eventin Events Manager Favorites FluentBooking Fluent Support FluentCRM Groundhogg Invite Anyone JetEngine Jetpack Meta Box Modern Events Calendar SliceWP Thrive Quiz Builder WP Job Manager WP PostRatings WP Ulike WP-Polls WPAdverts Charitable Gravity Kit Better Messages PrettyLinks QSM GeoDirectory WP Booking Calendar AffiliatePress BookingPress Mail Mint MailerPress View all integrations 👑 3rd party integrations Other teams have integrated GamiPress into their plugins, apps and themes, including: Academy LMS ActiveMember360 Better Messages Directorist Masteriyo Memberium WP Fusion View all 3rd party integrations ♥️ More plugins from the GamiPress team 🤖 AutomatorWP – Automator plugin that connects +300 plugins, platforms and sites together with support to webhooks. 🔗 ShortLinks Pro – Link management plugin for shortened URLs & branded affiliate links. 📋 BBForms – Code form plugin designed to help you build multipurpose forms in seconds!

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C