VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

JoomSport – for Sports: Team & League, Football, Hockey & more security & vulnerabilities

joomsport-sports-league-results-management— active installsLast vulnerability Oct 29, 2026

No known unpatched vulnerabilities in the latest version

All 17 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin
17Known vulnerabilities
  • Critical4
  • High5
  • Medium8
  • Low0
Vulnerabilities per year
2019: 1 vulnerability1192021: 1 vulnerability1212022: 3 vulnerabilities3222024: 2 vulnerabilities2242025: 2 vulnerabilities2252026: 8 vulnerabilities826

All JoomSport – for Sports: Team & League, Football, Hockey & more vulnerabilities

JoomSport – for Sports: Team & League, Football, Hockey & more vulnerabilities
SeverityVulnerabilityCVEPublished
Medium6.5Authenticated (Contributor+) SQL Injection via 'pgroup' Shortcode Attribute
≤5.7.14Update to 5.7.15
CVE-2026-118698
Medium6.5Authenticated (Contributor+) SQL Injection via 'team_id' Shortcode Attribute
≤5.7.11Update to 5.7.14
CVE-2026-118192
Medium4.9Authenticated (Administrator+) SQL Injection via 'order' Parameter
≤5.7.9Update to 5.7.10
CVE-2026-11920
Medium6.5Authenticated (Contributor+) SQL Injection via 'event' Shortcode Attribute
≤5.7.9Update to 5.7.10
CVE-2026-13010
Medium4.3Authenticated (Subscriber+) Missing Authorization to Arbitrary Group Creation/Modification via season_groupedit AJAX action
≤5.7.8Update to 5.7.9
CVE-2026-12134
Medium4.3Authenticated (Subscriber+) Missing Authorization to Arbitrary Group Deletion via season_groupdel AJAX action
≤5.7.8Update to 5.7.9
CVE-2026-12133
High7.5Unauthenticated SQL Injection via 'sortf' Parameter
≤5.7.7Update to 5.7.8
CVE-2026-6929
High7.5Unauthenticated SQL Injection
≤5.7.7Update to 5.7.8
CVE-2026-42647
Critical9.8Unauthenticated Directory Traversal to Local File Inclusion
≤5.7.3Update to 5.7.4
CVE-2025-7721
High7.1Reflected Cross-Site Scripting via page
≤5.6.17Update to 5.6.18
CVE-2024-12633
Medium4.3Missing Authorization
≤5.6.3Update to 5.6.4
CVE-2024-44031
Medium4.3Missing Authorization
≤5.3.0Update to 5.5.7
CVE-2024-43355
Critical9.8Unauthenticated SQL Injection
≤5.2.7Update to 5.2.8
CVE-2022-4050
High7.2Authentciated (Admin+) SQL Injection via orderby
≤5.2.5Update to 5.2.6
CVE-2022-2717
High7.2Authenticated (Admin+) SQL Injection via orderby
≤5.2.5Update to 5.2.6
CVE-2022-2718
Critical9.8Object Injection
<5.1.8Update to 5.1.8
CVE-2021-24384
Critical9.8SQL Injection
<3.4Update to 3.4
CVE-2019-14348

JoomSport – for Sports: Team & League, Football, Hockey & more: common questions

Does JoomSport – for Sports: Team & League, Football, Hockey & more have known vulnerabilities?

Yes. VulnCrest Radar lists 17 known vulnerabilities in JoomSport – for Sports: Team & League, Football, Hockey & more: 4 critical, 5 high, 8 medium. None are known to affect version null.

How do I check which version of JoomSport – for Sports: Team & League, Football, Hockey & more I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent JoomSport – for Sports: Team & League, Football, Hockey & more vulnerability?

CVE-2026-118698, published Oct 29, 2026: JoomSport <= 5.7.14 - Authenticated (Contributor+) SQL Injection via 'pgroup' Shortcode Attribute. Severity: Medium (CVSS 6.5).

Is any JoomSport – for Sports: Team & League, Football, Hockey & more vulnerability listed in CISA KEV?

No. None of the known JoomSport – for Sports: Team & League, Football, Hockey & more vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?