CVE-2026-6929

🗓️ 13 May 2026 05:29:35Reported by WordfenceType

Unauthenticated time-based blind SQL Injection in JoomSport up to version 5.7.7 via sortf parameter.

Reporter	Title	Published	Views	Family All 7
ATTACKERKB	CVE-2026-6929	13 May 202605:29	–	attackerkb
Circl	CVE-2026-6929	14 May 202602:50	–	circl
CNNVD	WordPress plugin JoomSport SQL注入漏洞	13 May 202600:00	–	cnnvd
Cvelist	CVE-2026-6929 JoomSport <= 5.7.7 - Unauthenticated SQL Injection via 'sortf' Parameter	13 May 202605:29	–	cvelist
EUVD	EUVD-2026-29913	13 May 202605:29	–	euvd
NVD	CVE-2026-6929	13 May 202606:16	–	nvd
Positive Technologies	PT-2026-40579	13 May 202600:00	–	ptsecurity

Vulners

Node

beardev joomsport_for_sports:_team_&_league,_football,_hockey_&_moreRange≤5.7.7wordpress

[
  {
    "vendor": "beardev",
    "product": "JoomSport – for Sports: Team & League, Football, Hockey & more",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "5.7.7",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/changeset
plugins	www.plugins.trac.wordpress.org/browser/joomsport-sports-league-results-management/trunk/sportleague/classes/objects/class-jsport-playerlist.php
plugins	www.plugins.trac.wordpress.org/browser/joomsport-sports-league-results-management/tags/5.7.5/sportleague/base/wordpress/classes/class-jsport-getplayers.php
plugins	www.plugins.trac.wordpress.org/browser/joomsport-sports-league-results-management/trunk/sportleague/base/wordpress/classes/class-jsport-getplayers.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/28b730b3-4260-414f-8a4a-65ba5509449b
plugins	www.plugins.trac.wordpress.org/browser/joomsport-sports-league-results-management/tags/5.7.5/sportleague/classes/objects/class-jsport-playerlist.php

13 May 2026 14:43Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.17.5

EPSS0.00109

CWE-89