How severe is CVE-2022-4050?

CVE-2022-4050 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2022-4050 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 5% (91st percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2022-4050?

CVE-2022-4050 affects Beardev Joomsport. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2022-4050?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2022-4050 published?

CVE-2022-4050 was published on 2022-12-19 and last updated on 2026-06-17.

CVE-2022-4050

CVE-2022-4050 is a critical-severity vulnerability in Beardev Joomsport with a CVSS 3.x base score of 9.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
EPSS exploit prediction: 5% (91st percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Beardev Joomsport
Published: 2022-12-19
Last modified: 2026-06-17

Description

The JoomSport WordPress plugin before 5.2.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users

Frequently asked questions

What is CVE-2022-4050?: The JoomSport WordPress plugin before 5.2.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users
How severe is CVE-2022-4050?: CVE-2022-4050 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2022-4050 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 5% (91st percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2022-4050?: CVE-2022-4050 affects Beardev Joomsport. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2022-4050?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
When was CVE-2022-4050 published?: CVE-2022-4050 was published on 2022-12-19 and last updated on 2026-06-17.

References

https://wpscan.com/vulnerability/5c96bb40-4c2d-4e91-8339-e0ddce25912f

Affected products (1)

cpe:2.3:a:beardev:joomsport:*:*:*:*:*:wordpress:*:*

More vulnerabilities in Beardev Joomsport

CVE-2021-24384 — Critical (CVSS 9.8): The joomsport_md_load AJAX action of the JoomSport WordPress plugin before 5.1.8, registered for both unauthenticated…
CVE-2019-14348 — Critical (CVSS 9.8): The BearDev JoomSport plugin 3.3 for WordPress allows SQL injection to steal, modify, or delete database information…
CVE-2022-2718 — High (CVSS 7.2): The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to SQL…
CVE-2022-2717 — High (CVSS 7.2): The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to SQL…
CVE-2024-44031 — Medium (CVSS 4.3): Missing Authorization vulnerability in beardev JoomSport joomsport-sports-league-results-management.This issue affects…
CVE-2024-43355 — Medium (CVSS 4.3): Missing Authorization vulnerability in BearDev JoomSport allows Exploiting Incorrectly Configured Access Control…

All CVEs affecting Beardev Joomsport →