CVE-2024-12633: high-severity vulnerability in beardev JoomSport – for Sports: Team & League…
JoomSport <= 5.6.17 - Reflected Cross-Site Scripting via page
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.1epss 0.3%
The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page parameter in all versions up to, and including, 5.6.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Related CVEs — beardev JoomSport – for Sports: Team & League…
In the same product, most dangerous first.
CVE-2022-2718HIGHJoomSport – for Sports: Team & League, Football, Hockey & more <= 5.2.5 - Authenticated (Admin+) SQL Injection via orderbyEPSS 1.5%CVE-2022-2717HIGHJoomSport – for Sports: Team & League, Football, Hockey & more <= 5.2.5 - Authentciated (Admin+) SQL Injection via orderbyEPSS 1.5%CVE-2025-7721CRITICALJoomSport <= 5.7.3 - Unauthenticated Directory Traversal to Local File InclusionEPSS 0.7%CVE-2026-11920MEDIUMJoomSport <= 5.7.9 - Authenticated (Administrator+) SQL Injection via 'order' ParameterEPSS 0.5%CVE-2026-118192MEDIUMJoomSport <= 5.7.11 - Authenticated (Contributor+) SQL Injection via 'team_id' Shortcode AttributeEPSS 0.4%CVE-2026-12133MEDIUMJoomSport <= 5.7.8 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Group Deletion via season_groupdel AJAX actionEPSS 0.4%