WordPress Plugin Vulnerabilities

SportsPress < 2.7.2 - Authenticated Stored Cross-Site Scripting

Description

Any user with the role of administrator or League Manager is able to store XSS payloads in the custom delimiter setting of events pages. This will then execute on all events pages on the website.

Proof of Concept

Affects Plugins

Plugin icon
sportspress
Fixed in 2.7.2

References

CVE
CVE-2020-13892

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.2 (high)

Miscellaneous

Original Researcher
Rishi
Submitter
Rishi
Verified
No
WPVDB ID
87605daa-5410-4fb6-bf6c-79328f8e301a

Timeline

Publicly Published
2020-06-07 (about 5 years ago)
Added
2020-06-07 (about 5 years ago)
Last Updated
2020-06-08 (about 5 years ago)

Other

Published
Title
Published
2025-12-01
Title
Arconix Shortcodes <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-10-27
Title
Master Slider Pro <= 3.7.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2022-01-18
Title
The Buffer Button <= 1.0 - Authenticated Stored Cross Site Scripting (XSS)
Published
2024-09-12
Title
Neighborly <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode
Published
2024-07-11
Title
SKT Skill Bar < 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting