CVE-2026-13010

Name of the Vulnerable Software and Affected Versions JoomSport versions prior to 5.8.0

Description The JoomSport plugin for WordPress contains a time-based SQL Injection flaw. This occurs because the software fails to properly escape user-supplied parameters and lacks sufficient preparation of the SQL query. Authenticated users with contributor-level access or higher can exploit this by embedding a shortcode in posts or pages using the event attribute to append malicious SQL queries and extract sensitive information from the database.

Recommendations Update the plugin to a version newer than 5.7.9. As a temporary mitigation, restrict users with contributor-level access from embedding shortcodes in posts or pages.