What’s Vulnerable › Products
beardev JoomSport – for Sports: Team & League, Football, Hockey & more vulnerabilities
17 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 12 published in the last 12 months.
Latest beardev JoomSport – for Sports: Team & League, Football, Hockey & more vulnerabilities
- CVE-2026-118698 — JoomSport <= 5.7.14 - Authenticated (Contributor+) SQL Injection via 'pgroup' Shortcode Attribute (CVSS 6.5)
- CVE-2026-118192 — JoomSport <= 5.7.11 - Authenticated (Contributor+) SQL Injection via 'team_id' Shortcode Attribute (CVSS 6.5)
- CVE-2026-11920 — JoomSport <= 5.7.9 - Authenticated (Administrator+) SQL Injection via 'order' Parameter (CVSS 4.9)
- CVE-2026-13010 — JoomSport <= 5.7.9 - Authenticated (Contributor+) SQL Injection via 'event' Shortcode Attribute (CVSS 6.5)
- CVE-2026-12134 — JoomSport <= 5.7.8 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Group Creation/Modification via season_groupedit AJAX action (CVSS 4.3)
- CVE-2026-12133 — JoomSport <= 5.7.8 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Group Deletion via season_groupdel AJAX action (CVSS 4.3)
- CVE-2026-42647 — WordPress JoomSport plugin <= 5.7.7 - SQL Injection vulnerability (CVSS 9.3)
- CVE-2026-6929 — JoomSport <= 5.7.7 - Unauthenticated SQL Injection via 'sortf' Parameter (CVSS 7.5)
- CVE-2025-7721 — JoomSport <= 5.7.3 - Unauthenticated Directory Traversal to Local File Inclusion (CVSS 9.8)
- CVE-2024-12633 — JoomSport <= 5.6.17 - Reflected Cross-Site Scripting via page (CVSS 7.1)
- CVE-2024-44031 — WordPress JoomSport plugin <= 5.6.3 - Broken Access Control vulnerability (CVSS 8.8)
- CVE-2024-43355 — WordPress JoomSport plugin <= 5.3.0 - Broken Access Control vulnerability (CVSS 8.8)
- CVE-2022-4050 — JoomSport < 5.2.8 - Unauthenticated SQLi (CVSS 9.8)
- CVE-2022-2718 — JoomSport – for Sports: Team & League, Football, Hockey & more <= 5.2.5 - Authenticated (Admin+) SQL Injection via orderby (CVSS 4.9)
- CVE-2022-2717 — JoomSport – for Sports: Team & League, Football, Hockey & more <= 5.2.5 - Authentciated (Admin+) SQL Injection via orderby (CVSS 4.9)
- CVE-2021-24384 — JoomSport < 5.1.8 - Unauthenticated PHP Object Injection (CVSS 9.8)
- CVE-2019-14348 — (CVSS 9.8)