Vulnerabilities

TI-2026-27122 CVE-2026-34890 · GHSA-6jgp-7rr8-ccg5

WordPress MSTW League Manager plugin <= 2.10 - Cross Site Scripting (XSS) vulnerability

LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mark O’Donnell MSTW League Manager allows DOM-Based XSS.This issue affects MSTW League Manager: from n/a through 2.10.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00135 Published 2026-04-02 No fix listed CWE-79

TI-2025-39092 CVE-2025-62944 · GHSA-fv67-9vrp-68qg

WordPress MSTW CSV EXPORTER plugin <= 1.4 - Broken Access Control vulnerability

LOW 32

Missing Authorization vulnerability in Mark O'Donnell MSTW CSV EXPORTER mstw-csv-exporter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MSTW CSV EXPORTER: from n/a through <=…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00282 Published 2025-10-27 No fix listed CWE-862

TI-2025-36505 CVE-2025-58852 · GHSA-m8gf-v7hc-hc47

WordPress MSTW League Manager Plugin <= 2.10 - Cross Site Request Forgery (CSRF) Vulnerability

LOW 30

Cross-Site Request Forgery (CSRF) vulnerability in Mark O'Donnell MSTW League Manager mstw-league-manager allows Stored XSS.This issue affects MSTW League Manager: from n/a through <= 2.10.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00127 Published 2025-09-05 No fix listed CWE-352

TI-2025-23042 CVE-2025-31905 · GHSA-7278-qjv8-wjw8

WordPress Team Rosters Plugin <= 4.7 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mark O'Donnell Team Rosters team-rosters allows Reflected XSS.This issue affects Team Rosters: from n/a through <= 4.7…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00242 Published 2025-04-03 No fix listed CWE-79

TI-2024-12702 CVE-2024-13663 · GHSA-hwhv-hx2h-x5c2

Coaching Staffs <= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

LOW 30

The Coaching Staffs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mstw-cs-table' shortcode in all versions up to, and including, 1.5.1 due to insufficient input sanitization and outp…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.0033 Published 2025-02-19 No fix listed CWE-79

TI-2024-35110 CVE-2024-52439 · GHSA-7544-4q6w-5p3x

WordPress Team Rosters plugin <= 4.8.2 - PHP Object Injection vulnerability

MEDIUM 50

Deserialization of Untrusted Data vulnerability in Mark O'Donnell Team Rosters team-rosters allows Object Injection.This issue affects Team Rosters: from n/a through <= 4.8.2.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00556 Published 2024-11-20 No fix listed CWE-502