CVE-2026-14379 rubengc CVE debrief

Who should care

WordPress site administrators and defenders should assess exposure and apply patches or mitigations to prevent potential stored cross-site scripting attacks. This includes verifying if their WordPress sites use the GamiPress plugin version 7.9.4 or earlier and taking steps to secure their sites. Security teams and vulnerability management teams should also review the vulnerability and its potential impact on their organization.

Why it matters

CVE-2026-14379 is a stored cross-site scripting vulnerability in the GamiPress plugin for WordPress, allowing authenticated attackers to inject arbitrary web scripts. Defenders should assess exposure, apply patches, and monitor for suspicious activity.

• Defenders must verify if their WordPress sites use the GamiPress plugin version 7.9.4 or earlier.
• Successful exploitation could allow attackers to inject arbitrary web scripts, potentially leading to stored cross-site scripting attacks.
• Defenders should prioritize patching or mitigating the vulnerability to prevent potential attacks.
• Further investigation is needed to determine the full scope of affected versions and potential impact.

Technical summary

The GamiPress plugin for WordPress is vulnerable to stored cross-site scripting via the 'video_id' parameter in all versions up to, and including, 7.9.4. This allows authenticated attackers with subscriber-level access to inject arbitrary web scripts. The vulnerability arises from insufficient input sanitization and output escaping in the plugin. Defenders should prioritize patching or mitigating the vulnerability to prevent potential attacks. Further investigation is needed to determine the full scope of affected versions and potential impact.

Defensive priority

Medium priority for WordPress site administrators and defenders to assess exposure and apply patches or mitigations.

Recommended defensive actions

• Assess exposure by checking if the GamiPress plugin version is 7.9.4 or earlier
• Apply patches or updates to the GamiPress plugin to address the vulnerability
• Monitor for suspicious activity or injected scripts on WordPress sites using the GamiPress plugin
• Consider implementing additional security measures, such as input validation and output escaping, for WordPress sites
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, affected versions, and potential attack vectors. However, limited information is available on exploitation or victim impact. Defenders should verify if their WordPress sites use the GamiPress plugin version 7.9.4 or earlier and assess exposure. The CVE Program record and NIST NVD detail page offer additional context on the vulnerability and its potential impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.