CVE-2026-13010
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
The JoomSport plugin for WordPress up to version 5.7.9 is vulnerable to time-based SQL injection via the 'event' shortcode attribute. Insufficient escaping and lack of proper SQL query preparation allow authenticated attackers with contributor-level access or higher to append additional SQL queries.
Risk Assessment
An attacker can extract sensitive information from the database, such as user passwords or API keys, leading to a breach of confidentiality and system integrity.
Recommendation
Immediately update the JoomSport plugin to the latest available version that includes a security fix for this vulnerability.
Other vulnerabilities in JoomSport
See all- CVE-2026-12134Medium
The JoomSport plugin for WordPress up to version 5.7.8 contains an authorization bypass vulnerability. It allows authenticated attackers with subscriber-level access or higher to create arbitrary season groups and modify existing group names, participants, and round-type options. Exploitation requires obtaining the joomsportajaxnonce, which is exposed on frontend pages rendering a JoomSport shortcode.
- CVE-2026-12133Medium
The JoomSport plugin for WordPress up to version 5.7.8 contains a missing authorization vulnerability in the joomsport_season_groupdel() AJAX handler. It allows authenticated attackers with Subscriber-level access or higher to delete arbitrary JoomSport groups without proper capability checks.
Original NVD description (English source)
The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based SQL Injection via 'event' Shortcode Attribute in all versions up to, and including, 5.7.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The shortcode can be embedded in posts or pages by Contributor-level users, making this exploitable by any authenticated user with at least that role.