Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

5 records

Vendor: ThemeBoy Component: Sportspress Clear all filters
TI-2024-03718 CVE-2024-3986 · GHSA-g2j4-8f3h-m86r

SportsPress < 2.7.22 - Admin+ Stored XSS

Priority MEDIUM 55

The SportsPress WordPress plugin before 2.7.22 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilter…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00415 Published 2024-07-30 Fixed in 2.7.22 CWE-79
TI-2024-01093 CVE-2024-1178 · GHSA-c33g-4mp4-9vx4

SportsPress – Sports Club & League Manager <= 2.7.17 - Missing Authorization to Unauthenticated Event Permalink Update

Priority LOW 30

The SportsPress – Sports Club & League Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the settings_save() function in all versions up to, and includin…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00427 Published 2024-03-05 No fix listed CWE-862
TI-2021-06862 CVE-2021-24578 · GHSA-jjmw-3x38-cvq5

SportsPress < 2.7.9 - Reflected Cross-Site Scripting

Priority LOW 29

The SportsPress WordPress plugin before 2.7.9 does not sanitise and escape its match_day parameter before outputting back in the Events backend page, leading to a Reflected Cross-Site Scripting issue

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00827 Published 2021-12-21 Fixed in 2.7.9 CWE-79