CVE-2026-118698

MediumCVSS 6.5/10Last modified Oct 30, 2026

Description

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to generic SQL Injection via the 'pgroup' parameter in all versions up to, and including, 5.7.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. A Contributor-level user can trigger the vulnerable code path by authoring a post containing the [jsMatchPlayerList] shortcode with a malicious pgroup value and previewing it, as WordPress allows shortcode execution during post preview for the post's author.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Oct 30, 2026
Last modified
Oct 30, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-11876.4The ZoomifyWP Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'filename' parameter of the 'zoomify' shortcodeCVE-2026-118705.4The WP Ghost (Hide My WP Ghost) WordPress plugin before 7.0.05 does not verify that client IP information comes from a trusted proxy beforeCVE-2026-1187008.8Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-1187018.8Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-1187028.8Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-1187038.8Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-1187048.8Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-1187058.8Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-1187068.8Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-1187078.8Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-1187088.8Release of invalid pointer or reference in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-1187098.8Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVE-2026-118698: Medium severity, CVSS 6.5 | Vulnix