Football Pool <= 2.13.4 - Authenticated (Subscriber+) Reflected Cross-Site Scripting

Summary

The Football Pool plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `shouttext` POST parameter of the Shoutbox widget in all versions up to, and including, 2.13.4 due to insufficient input sanitization and output escaping. When a shoutbox form submission fails the nonce check (or `shouttext` is empty, or the user is unable to save), the raw POST value is echoed back into a `<textarea>` element using `printf('%s', ...)` with no HTML escaping. This makes it possible for unauthenticated attackers to execute arbitrary web scripts in the browser of an authenticated victim (Subscriber-level or higher) who is tricked into submitting a crafted POST request to a page that contains the Shoutbox widget.

Timeline

1. Aug 5, 2026, 4:25 AM UTCCVE published
2. Aug 5, 2026, 4:19 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Aug 5, 2026, 4:19 PM UTCRecord last updated

Affected versions

• antoineh Football Pool

  through 2.13.4

References 8