Joan Vulnerabilities

The Jock On Air Now (JOAN) plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 6.0.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 6.0.4

Fixed in:

6.0.5

Disclosed:

Oct 2, 2025

CVE-2025-58986 on NVD →

The Jock on air now plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings and 'show-time-curd' AJAX action in versions up to, and including, 5.6.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVSS:

7.2

Affected:

up to 5.6.2

Fixed in:

5.6.3

Disclosed:

Aug 18, 2021

The Jock on air now plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.6.1. This is due to missing or incorrect nonce validation when saving its settings. This makes it possible for unauthenticated attackers to change arbitrary plugin settings via a forged request grant...

CVSS:

6.5

Affected:

up to 5.6.1

Fixed in:

5.6.2

Disclosed:

Aug 18, 2021

The Jock on air now plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘$_SERVER['PHP_SELF']’ variable in versions up to, and including, 5.6.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pag...

CVSS:

6.1

Affected:

up to 5.6.1

Fixed in:

5.6.2

Disclosed:

Aug 18, 2021