The vulnerability is a stored Cross‑Site Scripting flaw that occurs when the 'heading_size' attribute of the gamipress_achievement shortcode is supplied with unescaped input. Because the plugin forwards the attribute value directly into the rendered HTML without escaping, an attacker with contributor‑level access can insert malicious JavaScript. This allows the attacker to run code in the browser context of any visitor who loads the affected page, potentially leading to defacement, credential theft, or session hijacking. The weakness is identified as CWE‑79.

This flaw affects all releases of the GamiPress plugin up to and including version 7.9.9.1, which is distributed for WordPress sites that use the Gamification plugin to award points, achievements, badges, and ranks. The issue is present in the core shortcode handling code and applies to all users who have contributor or higher roles with the ability to edit or create content that includes the gamipress_achievement shortcode.

The CVSS score of 6.4 indicates a moderate severity, and the EPSS score of less than 1 % suggests low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. An attacker would need authenticated access with at least contributor privileges, which is a common role for content editors. Once the attack vector is achieved, the injected script runs on every page that displays the shortcode, offering wide reach. The exploitation requires only the insertion of malicious payload into the attribute, a trivial action for an authorized user.