Stored cross-site scripting in Football Pool WordPress plugin
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
The Football Pool plugin for WordPress is affected in all versions up to and including 2.13.5. Insufficient input sanitization and output escaping of the shouttext parameter cause a stored cross-site scripting flaw (CWE-79). An authenticated attacker with subscriber-level access or above can inject scripts that run when a user opens the admin Edit view for a shout.
Written with Claude Haiku 5.5 from the sources below · 2026-11-07
Description from the CNA
The Football Pool plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shouttext' parameter in all versions up to, and including, 2.13.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected script only fires in the admin Edit view for a shout; the public Shoutbox widget and the admin list view both encode output via Football_Pool_Utils::xssafe(), making the admin Edit view the sole unescaped sink.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for Football Pool.
Written with Claude Haiku 5.5 from the sources below · 2026-11-07
Timeline
- 2026-11-07 Threatist record created from CVE-2026-118050
- 2026-11-07 Alias added: GHSA-c5qf-gq6g-355q
- 2026-11-07 CISA SSVC decision points changed
- 2026-11-07 Priority changed: MEDIUM → LOW
References
Other 6
- https://www.wordfence.com/threat-intel/vulnerabilities/id/ac3e048d-9ebd-41c2-9dbd-751adae10380?source=cve
- https://plugins.trac.wordpress.org/browser/football-pool/tags/2.13.5/admin/class-football-pool-admin.php#L654
- https://plugins.trac.wordpress.org/browser/football-pool/tags/2.13.5/admin/class-football-pool-admin-shoutbox.php#L100
- https://plugins.trac.wordpress.org/browser/football-pool/tags/2.13.5/classes/class-football-pool-shoutbox.php#L57
- https://plugins.trac.wordpress.org/browser/football-pool/tags/2.13.5/widgets/widget-football-pool-shoutbox.php#L84
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3775727%40football-pool&new=3775727%40football-pool
More AntoineH vulnerabilities
- TI-2017-13697 The football-pool plugin before 2.6.5 for WordPress has multiple XSS issues. CVSS 3.0MEDIUM 6.1
- TI-2025-36631 WordPress Football Pool Plugin <= 2.12.6 - Cross Site Scripting (XSS) Vulnerability CVSS 3.1MEDIUM 6.5
- TI-2025-33247 WordPress Football Pool plugin <= 2.12.5 - Cross Site Scripting (XSS) Vulnerability CVSS 3.1MEDIUM 6.5
- TI-2026-07728 Football Pool <= 2.13.4 - Authenticated (Subscriber+) Reflected Cross-Site Scripting CVSS 3.1MEDIUM 6.1
- TI-2025-04930 Football Pool <= 2.12.4 - Authenticated (Administrator+) Stored Cross-Site Scripting CVSS 3.1MEDIUM 5.5
- TI-2025-22034 WordPress Football Pool plugin <= 2.12.2 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability CVSS 3.1MEDIUM 4.3
Sources
- CVE-2026-118050 · CVE Program
- CVE-2026-118050 · NVD
- GHSA-c5qf-gq6g-355q · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences