Log in Start free

rubengc

Products

ProductCVEsExploitedLatest
GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress11–Aug 1, 2026
AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress6–Aug 22, 2026
GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI3–Nov 7, 2026
AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI1–Oct 10, 2026
GamiPress – Button1–Mar 20, 2024
GamiPress – Link1–Jun 5, 2024

Exploited and recent CVEs

  • CVE-2026-121792 Medium 6.5 GamiPress <= 8.1.1 - Authenticated (Subscriber+) SQL Injection via 'Gravity Forms Name/List Field' Parameter –
  • CVE-2026-104728 Medium 4.3 AutomatorWP <= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via wp_ajax_automatorwp_fluentform_get_forms AJAX Action 0.3%
  • CVE-2026-14379 Medium 6.4 GamiPress <= 7.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'video_id' Parameter 0.2%
  • CVE-2026-15439 Medium 6.5 GamiPress <= 7.9.7 - Authenticated (Subscriber+) SQL Injection 0.4%
  • CVE-2026-76074 Medium 4.3 AutomatorWP <= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via automatorwp_campaign_monitor_get_lists AJAX Action 0.4%
  • CVE-2026-76057 Medium 4.3 AutomatorWP <= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via automatorwp_convertkit_get_forms AJAX Action 0.4%
  • CVE-2026-16091 Medium 6.4 GamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'gamipress_rank' Shortcode 0.3%
  • CVE-2026-16090 Medium 6.4 GamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via gamipress_achievement Shortcode 0.3%
  • CVE-2026-15730 Medium 6.4 GamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'heading_size' Shortcode Attribute 0.4%
  • CVE-2026-13450 Medium 5.3 GamiPress <= 7.9.4 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'access' Parameter 0.7%
  • CVE-2025-13812 Medium 4.3 GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress <= 7.6.1 - Missing Authorization to Authenticated (Subscriber+) Information Exposure 0.2%
  • CVE-2025-9539 High 8.0 AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress <= 5.3.6 - Missing Authorization To Authenticated (Subscriber+) Remote Code Execution via Automation Creation 0.5%
  • CVE-2025-9542 Medium 5.4 AutomatorWP <= 5.3.7 - Authenticated (Subscriber+) Missing Authorization to Multiple Functions 0.2%
  • CVE-2025-5487 High 7.2 AutomatorWP <= 5.2.5 - Authenticated (Administrator+) SQL Injection via field_conditions 0.4%
  • CVE-2024-13496 High 7.5 GamiPress <= 7.3.1 - Unauthenticated SQL Injection via orderby Parameter 2.2%
  • CVE-2024-13499 High 7.3 GamiPress <= 7.2.1 - Unauthenticated Arbitrary Shortcode Execution via gamipress_do_shortcode() Function 0.6%
  • CVE-2024-13495 High 7.3 GamiPress <= 7.2.1 - Unauthenticated Arbitrary Shortcode Execution via gamipress_ajax_get_logs Function 0.6%
  • CVE-2024-12626 Critical 9.6 AutomatorWP <= 5.0.9 - Reflected Cross-Site Scripting via a-0-o-search_field_value 0.7%
  • CVE-2024-11036 High 7.3 GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress <= 7.1.5 - Unauthenticated Arbitrary Shortcode Execution via gamipress_get_user_earnings 0.7%
  • CVE-2024-5536 Medium 6.4 GamiPress – Link <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.3%
  • CVE-2024-2783 Medium 6.4 GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress <= 6.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode 0.4%
  • CVE-2024-1799 High 8.8 GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress <= 6.8.6 - Authenticated (Contributor+) SQL Injection via Shortcode 1.0%
  • CVE-2024-2460 Medium 6.4 GamiPress – Button <= 1.0.7 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode 0.4%