What’s Vulnerable › Vulnerabilities

CVE-2022-1549: WP Athletics <= 1.1.7 - Subscriber+ Stored Cross-Site Scripting

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-06-13 · updated 2026-06-17
• Weakness: CWE-79

Description

The WP Athletics WordPress plugin through 1.1.7 does not sanitize parameters before storing them in the database, nor does it escape the values when outputting them back in the admin dashboard, leading to a Stored Cross-Site Scripting vulnerability.

Affected products

• WP Athletics: through 1.1.7

References

• https://wpscan.com/vulnerability/afef06f5-71a6-4372-9648-0db59f9b254f
• https://wpscan.com/vulnerability/afef06f5-71a6-4372-9648-0db59f9b254f

Get alerted when CVE-2022-1549 or the next vulnerability affects your stack