WordPress Plugin Vulnerabilities

Live Scores for SportsPress < 1.9.1 - Reflected Cross-Site Scripting

Description

The plugin does not sanitise the lsfs_match_date parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue

Proof of Concept

Affects Plugins

Plugin icon
live-scores-for-sportspress
Fixed in 1.9.1

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.1 (high)

Miscellaneous

Original Researcher
WPScanTeam
Verified
Yes
WPVDB ID
441a970d-a1c7-4abd-99e3-47acd2d2966b

Timeline

Publicly Published
2021-08-24 (about 4 years ago)
Added
2021-08-24 (about 4 years ago)
Last Updated
2021-08-24 (about 4 years ago)

Other

Published
Title
Published
2023-01-30
Title
WP Email Capture < 3.10 - Admin+ Stored XSS
Published
2024-10-31
Title
Marquee Elementor with Posts <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2022-05-09
Title
StaffList < 3.1.7 - Reflected Cross-Site Scripting
Published
2023-05-30
Title
Woocommerce Order address Print <= 3.2 - Reflected XSS
Published
2023-03-03
Title
Schedulicity - Easy Online Scheduling <= 2.21 - Contributor+ Stored XSS