CVE-2026-118192Published
JoomSport <= 5.7.11 - Authenticated (Contributor+) SQL Injection via 'team_id' Shortcode Attribute
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-118192 · Microsoft / collected KEV context
cve-program · CVE-2026-118192
- https://www.wordfence.com/threat-intel/vulnerabilities/id/31931ac8-08f8-4fe7-9318-5a1d8dc89bed?source=cve
- https://plugins.trac.wordpress.org/browser/joomsport-sports-league-results-management/tags/5.7.11/sportleague/base/wordpress/classes/class-jsport-getplayers.php#L136
- https://plugins.trac.wordpress.org/browser/joomsport-sports-league-results-management/tags/5.7.11/includes/joomsport-shortcodes.php#L485
- https://plugins.trac.wordpress.org/browser/joomsport-sports-league-results-management/tags/5.7.11/sportleague/classes/objects/class-jsport-team.php#L39
- https://plugins.trac.wordpress.org/browser/joomsport-sports-league-results-management/tags/5.7.11/sportleague/classes/objects/class-jsport-team.php#L280
- https://plugins.trac.wordpress.org/changeset/3770486
- https://plugins.trac.wordpress.org/changeset/3770486/joomsport-sports-league-results-management/trunk/sportleague/base/wordpress/classes/class-jsport-getplayers.php
Related operational evidence
Explicit CVE identifiers- JoomSport <= 5.7.11 - Authenticated (Contributor+) SQL Injection via 'team_id' Shortcode Attribute · Newly collected advisory · 29 Oct 2026