MSTW League Manager
MSTW League Manager has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2025 and 2026; none of them are fixed as of September 2026. Their average CVSS score is 5.3, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (50%). Other recurring categories include Cross-Site Scripting.
None of the 2 issues recorded for MSTW League Manager have a published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.
2 independent researchers contributed these findings, one record each. MSTW League Manager is installed on roughly 100 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.6.7.
CVE-2026-34890MSTW League Manager <= 2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records
MSTW League Manager
Author
Mark O'Donnell
The MSTW League Manager plugin manages multiple sports leagues, each with multiple seasons. A “league” can be a league (like the Premier League or Pac 12) or a round robin tournament. A shortcodes are available to display a variety of league standings tables, league schedules, individual team schedules, scoreboards, schedule ‘sliders’, and schedule ‘tickers’. These front end displays can be formatted via a rich set of display settings and shortcode arguments. Displays may be further styled via the custom stylesheets. Helpful Links
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C