Executive brief
The Sports Club Management plugin for WordPress, used to manage athletic organizations and member data, contains a security flaw that allows users with basic contributor permissions to inject malicious scripts into the website. These scripts are saved on the site and will run automatically in the browser of any visitor who views the affected page. This could lead to unauthorized actions being performed on behalf of site administrators or the theft of sensitive session information.
Technical details
The Sports Club Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on the 'before' and 'after' attributes of the 'scm_member_data' shortcode. An authenticated attacker with Contributor-level permissions or higher can exploit this by embedding malicious JavaScript within the shortcode attributes. When a page containing the shortcode is rendered, the script executes in the context of the victim's browser. This vulnerability is present in all versions up to and including 1.12.9. The issue is tracked as CWE-79.
Affected products
- pstruik Sports Club Management <= 1.12.9
Timeline
- 2026-04-08: disclosed
- 2026-04-08: advisory
References
- https://plugins.trac.wordpress.org/browser/sports-club-management/tags/1.12.9/code/members_shortcodes.php
- https://plugins.trac.wordpress.org/browser/sports-club-management/trunk/code/members_shortcodes.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/30a6d334-3838-4ed4-b688-c3887d9091c0?source=cve