These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI plugin for WordPress is vulnerable to authorization bypass. This CVE was published on 2026-10-10T08:17:03.933Z and was last modified on 2026-10-11T17:16:59.637Z. The NVD entry is currently . The vulnerability allows authenticated attackers to enumerate Fluent Forms records, potentially leading to information disclosu [truncated]
A vulnerability in the GamiPress plugin for WordPress allows authenticated attackers with subscriber-level access to inject arbitrary web scripts via the 'video_id' parameter, potentially leading to stored cross-site scripting attacks. This issue arises from insufficient input sanitization and output escaping in the plugin. Defenders should assess exposure and apply patches or mitigations to prevent poten [truncated]
The GamiPress plugin for WordPress, up to and including version 7.9.7, is vulnerable to authenticated SQL Injection via the 'q' parameter of the wpForo integration AJAX selector (action gamipress_wpforo_get_posts). An attacker with a Subscriber account can exploit this by injecting boolean-based SQL, breaking out of the string and injecting SQL, due to the value being passed through $wpdb->esc_like() and [truncated]
The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gamipress_rank' Shortcode in all versions up to, and including, 7.9.9.1 due to insufficient input sanitization and output escaping. This vulnerability allows authenticated attackers with contributor-level access to inject web scripts tha [truncated]
The GamiPress plugin for WordPress, specifically versions up to and including 7.9.9.1, is vulnerable to Stored Cross-Site Scripting (XSS) via the 'heading_size' Shortcode Attribute in 'gamipress_achievement'. This vulnerability is due to insufficient input sanitization and output escaping, allowing authenticated attackers with contributor-level access and above to inject arbitrary web scripts. These scrip [truncated]