Known vulnerabilities in Jock On Air Now (JOAN)

The ultimate radio station scheduling plugin. Manage DJs, display current shows, and engage your audience with real-time on-air information.

4Reported vulnerabilities

7.2Highest CVSS score

6.1.3Latest version

500+Active installs

What to do now

Update Jock On Air Now (JOAN) to 6.0.5 or later. 4 of these have a fixed version available. Updating resolves them.

Plugin last updated: July 2, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
WF-9cf12dc1-7b66-4c6e-8c3e-5915e1032303	High 7.2	—	5.6.2 and earlier	`5.6.3`	August 18, 2021
WF-898ba68f-2b0c-462a-87ee-272ee624396e	Medium 6.5	—	5.6.1 and earlier	`5.6.2`	August 18, 2021
WF-a401db3e-2cf2-4283-bfbe-d4a9587966e1	Medium 6.1	—	5.6.1 and earlier	`5.6.2`	August 18, 2021
CVE-2025-58986	Medium 4.3	0.3%	6.0.4 and earlier	`6.0.5`	October 2, 2025

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.