Mark O’Donnell vulnerabilities

Products

• MSTW League Manager 2
• Team Rosters 2
• MSTW CSV EXPORTER 1

Latest Mark O’Donnell CVEs

Newest publication first

1. CVE-2026-34890 WordPress MSTW League Manager plugin <= 2.10 - Cross Site Scripting (XSS) vulnerability

   Published 2026-04-02

   Medium·CVSS 6.5 EPSS 0.14%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mark O’Donnell MSTW League Manager allows DOM-Based XSS.This issue affects MSTW League Manager: from n/a through 2.10.

2. CVE-2025-62944 WordPress MSTW CSV EXPORTER plugin <= 1.4 - Broken Access Control vulnerability

   Published 2025-10-27

   Medium·CVSS 5.3 EPSS 0.28%

   Missing Authorization vulnerability in Mark O'Donnell MSTW CSV EXPORTER mstw-csv-exporter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MSTW CSV EXPORTER: from n/a through <= 1.4.

3. CVE-2025-58852 WordPress MSTW League Manager Plugin <= 2.10 - Cross Site Request Forgery (CSRF) Vulnerability

   Published 2025-09-05

   High·CVSS 7.1 EPSS 0.13%

   Cross-Site Request Forgery (CSRF) vulnerability in Mark O'Donnell MSTW League Manager mstw-league-manager allows Stored XSS.This issue affects MSTW League Manager: from n/a through <= 2.10.

4. CVE-2025-31905 WordPress Team Rosters Plugin <= 4.7 - Reflected Cross Site Scripting (XSS) vulnerability

   Published 2025-04-03

   High·CVSS 7.1 EPSS 0.24%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mark O'Donnell Team Rosters team-rosters allows Reflected XSS.This issue affects Team Rosters: from n/a through <= 4.7.

5. CVE-2024-52439 WordPress Team Rosters plugin <= 4.8.2 - PHP Object Injection vulnerability

   Published 2024-11-20

   Critical·CVSS 9.8 EPSS 0.56%

   Deserialization of Untrusted Data vulnerability in Mark O'Donnell Team Rosters team-rosters allows Object Injection.This issue affects Team Rosters: from n/a through <= 4.8.2.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.