GCVE - cpe:2.3:a:themeboy:sportspress:*:*:*:*:*:wordpress:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:themeboy:sportspress:*:*:*:*:*:wordpress:*:*

part: a version: * update: *

Vendor	Themeboy (`930d271b-8a7b-511e-9d8e-7628d6cf6b14`)
Product	Sportspress (`5ad9b834-cb17-505d-ab65-b2c75084b9f3`)
Edition	*
Language	*
Software edition	*
Target software	wordpress
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/themeboy/sportspress`	purl2cpe	2026-06-01 10:18:17.879541
`pkg:github/wp-plugins/sportspress`	purl2cpe	2026-06-01 10:18:17.879543

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-3986`	vulnerable	2026-06-08 06:43:52.048072	SportsPress < 2.7.22 - Admin+ Stored XSS The SportsPress WordPress plugin before 2.7.22 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Published: 2024-07-30T06:00:07.510Z Updated: 2025-03-13T13:42:56.632Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/76c78f8e-e3da-47d9-9bf4-70e9dd125b82/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-34824`	vulnerable	2026-06-08 06:37:35.083782	WordPress SportsPress – Sports Club & League Manager plugin <= 2.7.20 - Broken Access Control vulnerability MEDIUM (4.3) Missing Authorization vulnerability in ThemeBoy SportsPress – Sports Club & League Manager.This issue affects SportsPress – Sports Club & League Manager: from n/a through 2.7.20. Published: 2024-06-11T09:27:52.091Z Updated: 2026-04-28T16:09:51.620Z Open on db.gcve.eu Reference links https://patchstack.com/database/vulnerability/sportspress/wordpress-sportspress-sports-club-league-manager-plugin-2-7-20-broken-access-control-vulnerability?_s_id=cve	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-1178`	vulnerable	2026-06-08 06:25:39.469655	SportsPress – Sports Club & League Manager <= 2.7.17 - Missing Authorization to Unauthenticated Event Permalink Update MEDIUM (5.3) The SportsPress – Sports Club & League Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the settings_save() function in all versions up to, and including, 2.7.17. This makes it possible for unauthenticated attackers to update the permalink structure for the clubs Published: 2024-03-05T01:55:47.179Z Updated: 2026-04-08T16:34:30.958Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/098dfee2-ba0b-420f-89ed-8ad1e41faec4?source=cve https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3043889%40sportspress&new=3043889%40sportspress&sfp_email=&sfph_mail=	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-24578`	vulnerable	2026-06-08 05:30:38.801982	SportsPress < 2.7.9 - Reflected Cross-Site Scripting The SportsPress WordPress plugin before 2.7.9 does not sanitise and escape its match_day parameter before outputting back in the Events backend page, leading to a Reflected Cross-Site Scripting issue Published: 2021-12-21T08:45:25.000Z Updated: 2024-08-03T19:35:20.197Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/69351798-c790-42d4-9485-1813cd325769	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-13892`	vulnerable	2026-06-08 05:18:01.299373	Details available The SportsPress plugin before 2.7.2 for WordPress allows XSS. Published: 2020-06-09T17:40:32.000Z Updated: 2024-08-04T12:32:14.301Z Open on db.gcve.eu Reference links https://wpvulndb.com/vulnerabilities/10257	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.