The JoomSport – for Sports: Team & League WordPress plugin is vulnerable to a generic SQL Injection via the 'pgroup' attribute in the [jsMatchPlayerList] shortcode. The flaw arises from inadequate escaping and lack of prepared statements, enabling a contributor-level attacker to inject arbitrary SQL fragments. The resulting execution can read or potentially modify sensitive database content, as the injection occurs within a contextual query already in place. This corresponds to CWE‑89 and represents a moderate severity vulnerability.

WordPress sites running the JoomSport plugin version 5.7.14 or earlier are affected. The vendor, beardev, provides the JoomSport – for Sports: Team & League, Football, Hockey & more plugin. The issue applies to all revisions up to and including 5.7.14; later versions are not known to contain the flaw.

The CVSS score of 6.5 indicates a moderate threat level. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires authenticated access with at least Contributor role, which is permissible on many WordPress sites. An attacker can craft a malicious post containing the shortcode and preview it to trigger the injection, thereby gaining read or delete capabilities from the database. In a high‑profile environment, the potential for data compromise warrants immediate attention.