Vulnerabilities

TI-2026-41572 CVE-2026-57749 · GHSA-h7mh-qq2p-78hm

WordPress SportsPress Pro plugin <= 2.7.29 - Local File Inclusion vulnerability

LOW 35

Contributor Local File Inclusion in SportsPress Pro <= 2.7.29 versions.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00429 Published 2026-07-02 No fix listed CWE-98

TI-2025-14017 CVE-2025-15368 · GHSA-gfhr-9qxh-9792

SportsPress <= 2.7.26 - Authenticated (Contributor+) Local File Inclusion via Shortcode

MEDIUM 42

The SportsPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.7.26 via shortcodes 'template_name' attribute.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00824 Published 2026-02-04 No fix listed CWE-98

TI-2025-38437 CVE-2025-62115 · GHSA-f6q2-fm8v-vhr3

WordPress Hide Plugins plugin <= 1.0.4 - Broken Access Control vulnerability

LOW 19

Missing Authorization vulnerability in ThemeBoy Hide Plugins hide-plugins allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hide Plugins: from n/a through <= 1.0.4.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0022 Published 2025-12-31 No fix listed CWE-862

TI-2024-03718 CVE-2024-3986 · GHSA-g2j4-8f3h-m86r

SportsPress < 2.7.22 - Admin+ Stored XSS

MEDIUM 55

The SportsPress WordPress plugin before 2.7.22 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilter…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00415 Published 2024-07-30 Fixed in 2.7.22 CWE-79

TI-2024-23111 CVE-2024-34824 · GHSA-xw37-xfrp-pmwc

WordPress SportsPress – Sports Club & League Manager plugin <= 2.7.20 - Broken Access Control vulnerability

LOW 28

Missing Authorization vulnerability in ThemeBoy SportsPress – Sports Club & League Manager.This issue affects SportsPress – Sports Club & League Manager: from n/a through 2.7.20.

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00246 Published 2024-06-11 No fix listed CWE-862

TI-2024-01093 CVE-2024-1178 · GHSA-c33g-4mp4-9vx4

SportsPress – Sports Club & League Manager <= 2.7.17 - Missing Authorization to Unauthenticated Event Permalink Update

LOW 30

The SportsPress – Sports Club & League Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the settings_save() function in all versions up to, and includin…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00427 Published 2024-03-05 No fix listed CWE-862

TI-2021-06862 CVE-2021-24578 · GHSA-jjmw-3x38-cvq5

SportsPress < 2.7.9 - Reflected Cross-Site Scripting

LOW 29

The SportsPress WordPress plugin before 2.7.9 does not sanitise and escape its match_day parameter before outputting back in the Events backend page, leading to a Reflected Cross-Site Scripting issue

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00827 Published 2021-12-21 Fixed in 2.7.9 CWE-79

TI-2020-10873 CVE-2020-13892 · GHSA-4f8r-r8j4-c56j

The SportsPress plugin before 2.7.2 for WordPress allows XSS.

LOW 26

The SportsPress plugin before 2.7.2 for WordPress allows XSS.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00696 Published 2020-06-09 No fix listed CWE-79

Vulnerabilities

Filters