CVE-2024-2783: GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress <= 6.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 6.9.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-2783?
CVE-2024-2783 has been rated as a medium severity vulnerability due to the potential for Stored Cross-Site Scripting attacks.
How do I fix CVE-2024-2783?
To fix CVE-2024-2783, update GamiPress to version 6.9.1 or later to ensure proper input sanitization and output escaping.
What versions of GamiPress are affected by CVE-2024-2783?
All versions of GamiPress up to and including 6.9.0 are affected by CVE-2024-2783.
What type of vulnerability is CVE-2024-2783?
CVE-2024-2783 is a Stored Cross-Site Scripting vulnerability that can allow an attacker to inject malicious scripts.
Is there any workaround for CVE-2024-2783?
There is no official workaround for CVE-2024-2783, and updating to the latest version is recommended for immediate remediation.