Stored Cross-Site Scripting Vulnerability in Football Pool Plugin for WordPress

CVE-2026-118050

What is CVE-2026-118050?

The Football Pool plugin for WordPress allows stored Cross-Site Scripting through the 'shouttext' parameter due to inadequate input sanitization and output escaping. Authenticated attackers with subscriber-level access or higher can inject malicious scripts, which will execute when an administrator accesses an edited shout in the admin panel. This vulnerability remains significant as the affected output only occurs within the admin Edit view, exposing administrators to potential security risks.

References