Cross-Site Scripting Vulnerability in AntoineH Football Pool Plugin
CVE-2025-58987

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Football Pool
Vendor
CVE Published:
9 September 2025

What is CVE-2025-58987?

The AntoineH Football Pool plugin for WordPress contains a security flaw that allows for Stored Cross-Site Scripting (XSS) attacks due to improper input neutralization during web page generation. This vulnerability can be exploited by attackers to inject malicious scripts into web pages viewed by other users, compromising the security and confidentiality of user data. Users of versions from an unknown release up to 2.12.6 should take immediate action to safeguard their applications against this vulnerability.

Affected Version(s)

Football Pool <= 2.12.6

References

https://patchstack.com/database/wordpress/plugin/football...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Muhammad Yudha - DJ (Patchstack Alliance)
.
CVE-2025-58987 : Cross-Site Scripting Vulnerability in AntoineH Football Pool Plugin