Themeboy - vulnerabilities (CVEs)

8 CVEs in 4 products, 0 in the last 30 days, newest from 2026-07-02.

Products

CVE-2026-57749 - CVSS 7.5 (high), 2026-07-02: Contributor Local File Inclusion in SportsPress Pro <= 2.7.29 versions.
CVE-2025-15368 - CVSS 8.8 (high), 2026-02-04: The SportsPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.7.26 via shortcodes 'template_name'…
CVE-2025-62115 - CVSS 4.3 (medium), 2025-12-31: Missing Authorization vulnerability in ThemeBoy Hide Plugins hide-plugins allows Exploiting Incorrectly Configured Access Control Security Levels.This issue…
CVE-2024-3986 - CVSS 4.8 (medium), 2024-07-30: The SportsPress WordPress plugin before 2.7.22 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to…
CVE-2024-34824 - CVSS 6.3 (medium), 2024-06-11: Missing Authorization vulnerability in ThemeBoy SportsPress – Sports Club & League Manager.This issue affects SportsPress – Sports Club & League Manager: from…
CVE-2024-1178 - CVSS 5.3 (medium), 2024-03-05: The SportsPress – Sports Club & League Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on…
CVE-2021-24578 - CVSS 6.1 (medium), 2021-12-21: The SportsPress WordPress plugin before 2.7.9 does not sanitise and escape its match_day parameter before outputting back in the Events backend page, leading…
CVE-2020-13892 - CVSS 5.4 (medium), 2020-06-09: The SportsPress plugin before 2.7.2 for WordPress allows XSS.