CVE-2026-16090

CVE-2026-16090 is a stored XSS in GamiPress that exploits a sanitization gap specific to WordPress's shortcode architecture. A contributor-level user can inject malicious JavaScript through a shortcode attribute—specifically one that controls heading size or similar styling values—because the plugin stores the value using wp_kses_post at save time, then renders it without escaping at display time. The key detail: wp_kses_post doesn't neutralize attribute values, only raw HTML tags, so this isn't a case of sanitization failing—it's a case of the wrong sanitization applied to the wrong context. The contributor-level exploitability is what makes this severe. Most stored XSS vulnerabilities require author-level access or admin compromise. Here, any multi-author site with untrusted contributors has the conditions for compromise. A contributor injects the payload once, and it executes for every user who visits any page where that shortcode renders—which on a GamiPress site could include achievement pages, leaderboards, badge displays, forum posts, course progress pages, and checkout confirmations. This is a site-wide session compromise, not a page-level nuisance. GamiPress integrates with BuddyPress, bbPress, LearnDash, WooCommerce, and dozens of other plugins. When the shortcode renders inside a connected subsystem, the injected script inherits the session context of whoever's browsing. That means the payload executes with whatever privileges the current user has across the entire integration stack. The fix is straightforward: any shortcode attribute that gets inserted into HTML must use esc_attr() at render time, regardless of what sanitization was applied at save time. This is not a one-off developer error—this is a reproducible class of vulnerability in WordPress plugins. The same pattern appears in CVE-2019-10891, CVE-2021-3931, and CVE-2023-23499. The root cause is architectural: WordPress's shortcode API treats all attributes as untrusted at render time, but the platform's documentation and examples don't make this explicit for attribute contexts the way they do for raw HTML content. If you're running GamiPress, update immediately. Audit any custom shortcodes or custom GamiPress extensions for the same pattern—look for any shortcode attribute that outputs directly into HTML without esc_attr(). Assume any contributor-level account that existed before the patch may have introduced malicious payloads; review recent shortcode content in your database. Consider restricting contributor-level shortcode creation until you're patched, or at minimum audit that role's capabilities if you have multi-author sites.

Reviewed through automated stages and approved by a human before publication.