Reflected Cross-Site Scripting Vulnerability in JoomSport Plugin for WordPress
CVE-2024-12633

7.1HIGH

Key Information:

Vendor
Wordpress
Status
Joomsport – For Sports: Team & League, Football, Hockey & More
Vendor
CVE Published:
7 January 2025

Summary

The JoomSport plugin for WordPress exhibits a reflected cross-site scripting vulnerability due to inadequate input sanitization and output escaping. This flaw allows unauthenticated attackers to inject malicious web scripts through the 'page' parameter, which may execute if a user is tricked into clicking a crafted link. This presents a significant risk as it potentially compromises user security and privacy, making it essential for website administrators to apply mitigations and updates promptly.

Affected Version(s)

JoomSport – for Sports: Team & League, Football, Hockey & more * <= 5.6.17

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset/3209054/joom...

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Colin Xu
.