CVE-2020-13892: 
WordPress vulnerability analysis and mitigation

The SportsPress WordPress plugin versions prior to 2.7.2 were found to contain a Cross-Site Scripting (XSS) vulnerability, identified as CVE-2020-13892. The vulnerability was disclosed on June 9, 2020, affecting the SportsPress plugin, which is a sports club and league manager for WordPress websites (NVD Database, CVE Mitre).

The vulnerability has been assigned a CVSS v3.1 base score of 5.4 (Medium severity) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. Under CVSS v2.0, it received a base score of 3.5 (Low) with the vector (AV:N/AC:M/Au:S/C:N/I:P/A:N). The vulnerability is classified as CWE-79, which refers to Improper Neutralization of Input During Web Page Generation (NVD Database).

The Cross-Site Scripting vulnerability could allow attackers to inject malicious scripts into web pages viewed by users of the affected WordPress sites. This could potentially lead to the theft of sensitive information or manipulation of web content when users interact with the compromised pages (NVD Database).

The vulnerability requires an attacker to have low privileges and user interaction for successful exploitation. The attack complexity is considered low, indicating that the vulnerability is relatively straightforward to exploit once the necessary conditions are met (NVD Database).

The vulnerability was addressed in SportsPress version 2.7.2. Users are advised to update their installations to this version or later to mitigate the security risk (Trustwave Update).