CVE-2025-15368

🗓️ 04 Feb 2026 13:24:42Reported by WordfenceType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 42 Views

Authenticated contributors can trigger local file inclusion via shortcode in SportsPress up to 2.7.26.

Reporter	Title	Published	Views	Family All 12
GithubExploit	Exploit for CVE-2025-15368	10 Feb 202623:45	–	githubexploit
Circl	CVE-2025-15368	4 Feb 202614:24	–	circl
CNNVD	WordPress plugin SportsPress 安全漏洞	4 Feb 202600:00	–	cnnvd
Cvelist	CVE-2025-15368 SportsPress <= 2.7.26 - Authenticated (Contributor+) Local File Inclusion via Shortcode	4 Feb 202613:24	–	cvelist
EUVD	EUVD-2025-206819	4 Feb 202613:24	–	euvd
Kitploit	CVE-2025-15368-Exploit	25 Aug 202609:34	–	kitploit
NVD	CVE-2025-15368	4 Feb 202614:16	–	nvd
Patchstack	WordPress SportsPress plugin <= 2.7.26 - Authenticated (Contributor+) Local File Inclusion via Shortcode vulnerability	3 Feb 202623:44	–	patchstack
Positive Technologies	PT-2026-5886	4 Feb 202600:00	–	ptsecurity
RedhatCVE	CVE-2025-15368	5 Feb 202619:23	–	redhatcve

Vulners

Node

themeboy sportspressRange≤2.7.26wordpress

[
  {
    "vendor": "themeboy",
    "product": "SportsPress – Sports Club & League Manager",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "2.7.26",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/sportspress/tags/2.7.26/includes/sp-core-functions.php
plugins	www.plugins.trac.wordpress.org/browser/sportspress/tags/2.7.26/includes/class-sp-shortcodes.php
plugins	www.plugins.trac.wordpress.org/changeset
plugins	www.plugins.trac.wordpress.org/browser/sportspress/tags/2.7.26/includes/class-sp-shortcodes.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/27e40af7-5697-4482-a96d-9216886c363b

17 Jun 2026 08:37Current

6.5Medium risk

Vulners AI Score6.5

CVSS 3.18.8

EPSS0.0075

SSVC

CWE-98