Is my WordPress plugin safe?

Not this one?Team ShowcaseTeamJoomSport – for Sports: Team & League, Football, Hockey & moreWP Project Manager – Task, team, and project management plugin featuring kanban board and gantt chartsTeam ManagerSkTeamTeam Members

• Aug 5, 2026JoomSport – for Sports: Team & League, Football, Hockey & more: Time-based SQL InjectionCVE-2026-11920 · affects up to 5.7.9 · reported by WordfenceMedium 4.9

  The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based SQL Injection via the 'order' parameter in all versions up to, and including, 5.7.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The affected admin page lacks nonce or CSRF protection on the GET request, meaning an unauthenticated attacker could exploit this vulnerability by tricking an authenticated administrator into issuing a crafted request. Additionally, the vulnerability is only triggered when the 'orderby' parameter is also present and non-empty alongside the 'order' parameter.

  NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Jul 10, 2026JoomSport – for Sports: Team & League, Football, Hockey & more: Time-based SQL InjectionCVE-2026-13010 · affects up to 5.7.9 · reported by WordfenceMedium 6.5

  The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based SQL Injection via 'event' Shortcode Attribute in all versions up to, and including, 5.7.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The shortcode can be embedded in posts or pages by Contributor-level users, making this exploitable by any authenticated user with at least that role.

  NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Jul 2, 2026JoomSport – for Sports: Team & League, Football, Hockey & more: Authorization bypassCVE-2026-12134 · affects up to 5.7.8 · reported by WordfenceMedium 4.3

  The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.7.8. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to create arbitrary season groups or modify existing group names, participants, and round-type options. Exploitation requires obtaining the joomsportajaxnonce, which is exposed on frontend pages that render a JoomSport shortcode.

  NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Jul 1, 2026JoomSport – for Sports: Team & League, Football, Hockey & more: Missing Authorization to Arbitrary Group DeletionCVE-2026-12133 · affects up to 5.7.8 · reported by WordfenceMedium 4.3

  The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to Missing Authorization to Arbitrary Group Deletion in versions up to, and including, 5.7.8. This is due to a missing capability check in the joomsport_season_groupdel() AJAX handler, which only verifies a nonce before executing a DELETE query on attacker-supplied group IDs. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary JoomSport group records.

  NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Jun 11, 2026JoomSport: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-42647 · affects up to 5.7.7 · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Beardev JoomSport allows Blind SQL Injection. This issue affects JoomSport: from n/a through 5.7.7.

  NVD recordpatchstack.com

• May 13, 2026JoomSport – for Sports: Team & League, Football, Hockey & more: Time-based blind SQL InjectionCVE-2026-6929 · affects up to 5.7.7 · reported by WordfenceHigh 7.5

  The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'sortf' parameter in all versions up to, and including, 5.7.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

  NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Oct 3, 2025JoomSport – for Sports: Team & League, Football, Hockey & more: Local File InclusionCVE-2025-7721 · affects up to 5.7.3 · reported by WordfenceCritical 9.8

  The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.7.3 via the task parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.

  NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Jan 7, 2025JoomSport – for Sports: Team & League, Football, Hockey & more: Reflected Cross-Site ScriptingCVE-2024-12633 · affects up to 5.6.17 · reported by WordfenceHigh 7.1

  The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page parameter in all versions up to, and including, 5.6.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

  NVD recordplugins.trac.wordpress.orgwordfence.com

• Nov 1, 2024JoomSport: Missing AuthorizationCVE-2024-44031 · affects up to 5.6.3 · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in beardev JoomSport joomsport-sports-league-results-management.This issue affects JoomSport: from n/a through <= 5.6.3.

  NVD recordpatchstack.com

• Nov 1, 2024JoomSport: Missing AuthorizationCVE-2024-43355 · affects up to 5.3.0 · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in BearDev JoomSport allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JoomSport: from n/a through 5.3.0.

  NVD recordpatchstack.com

• Dec 19, 2022JoomSport: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-4050 · fixed in 5.2.8 · reported by WPScanCritical 9.8

  The JoomSport WordPress plugin before 5.2.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users

  NVD recordwpscan.comwpscan.com

• Sep 6, 2022JoomSport – for Sports: Team & League, Football, Hockey & more: SQL InjectionCVE-2022-2718 · affects up to 5.2.5 · reported by WordfenceHigh 7.2

  The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter on the joomsport-page-extrafields page in versions up to, and including, 5.2.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrative privileges, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

  NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Sep 6, 2022JoomSport – for Sports: Team & League, Football, Hockey & more: SQL InjectionCVE-2022-2717 · affects up to 5.2.5 · reported by WordfenceHigh 7.2

  The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter on the joomsport-events-form page in versions up to, and including, 5.2.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrative privileges, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

  NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Jul 6, 2021The joomsport_md_load AJAX action of the JoomSport WordPress plugin before 5.1.8, registered for both unauthenticated and unauthenticated users, unserialised usCVE-2021-24384 · fixed in 5.1.8 · reported by WPScanCritical 9.8

  The joomsport_md_load AJAX action of the JoomSport WordPress plugin before 5.1.8, registered for both unauthenticated and unauthenticated users, unserialised user input from the shattr POST parameter, leading to a PHP Object Injection issue. Even though the plugin does not have a suitable gadget chain to exploit this, other installed plugins could, which might lead to more severe issues such as RCE

  NVD recordwpscan.comwpscan.com

Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.