The GamiPress plugin for WordPress contains a stored cross‑site scripting vulnerability in the "heading_size" shortcode attribute. The plugin does not sanitize or escape the value of this attribute before it is rendered, allowing an attacker with contributor‑level or higher permissions to inject arbitrary JavaScript into post content. When a user views a page that contains the malicious shortcode, the injected script executes in the victim’s browser, which can lead to session hijacking, defacement, or redirection to malicious sites. The vulnerability is a classic input validation weakness classified as CWE‑79.

The vulnerability is present in all releases of the GamiPress plugin up to and including version 7.9.9.1. Users running any of these versions on a WordPress site are affected; the plugin is distributed under the rubengc vendor name "GamiPress – Gamification plugin to reward points, achievements, badges & ranks".

With a CVSS score of 6.4 the issue is considered moderately severe, and the EPSS score of less than 1% indicates a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. An attacker must first authenticate with at least contributor privileges and then insert malicious code into the shortcode attribute when editing or creating a post. Because the plugin reconstructs the dangerous HTML at render time, sanitization performed on save time is bypassed, allowing the stored payload to persist indefinitely.