The stored XSS vulnerability in GamiPress up to 7.9.4 allows an attacker with subscriber or higher privileges to inject arbitrary scripts via the 'video_id' parameter. As a result, any user who views the affected content will execute the injected scripts, enabling session hijacking, credential theft, or defacement. The weakness stems from insufficient input sanitization and output escaping in the plugin's YouTube integration code. This flaw affects the GamiPress gamification plugin for WordPress, all builds up to and including 7.9.4. The plugin is distributed by rubengc and integrates with WordPress as a site extension to award points and badges. No specific WordPress core versions are mentioned; any WordPress installation using an affected GamiPress version is vulnerable. The CVSS base score is 6.4, indicating moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. Exploitation requires an authenticated user with at least subscriber privileges; the attacker supplies a malicious payload through the 'video_id' field, which is stored and later rendered indiscriminately. Once injected, the script runs in the browser context of all users who view the page, creating widespread impact without additional compromise steps.

The GamiPress plugin for WordPress, developed by rubengc, is the primary affected system. All releases up to and including version 7.9.4 contain the vulnerability. Any WordPress site that has installed these versions of GamiPress and that includes the YouTube integration functionality is impacted.

The CVSS score of 6.4 classifies the vulnerability as moderately severe, while the EPSS score being unavailable does not provide a clear likelihood estimate. Because the flaw is not listed in CISA KEV, there is currently no publicly confirmed exploitation activity. However, the condition that the attacker must be an authenticated subscriber or higher means that an attacker with modest site privileges can achieve persistent cross‑site scripting that affects all other site users whenever they view the injected content.