Reflected Cross-Site Scripting Vulnerability in Football Pool Plugin for WordPress

CVE-2026-8790

What is CVE-2026-8790?

The Football Pool plugin for WordPress has a vulnerability that allows Reflected Cross-Site Scripting (XSS) via the shouttext POST parameter in the Shoutbox widget, present in all versions up to 2.13.4. This occurs due to inadequate input sanitization and improper output escaping techniques, which permit attackers to submit malicious scripts. When a form submission fails the nonce validation or if the shouttext is empty, the unfiltered POST data is rendered back to the user in a <textarea> element. If an authenticated user (Subscriber-level or higher) is deceived into sending a specially crafted POST request, an attacker can execute arbitrary scripts in their browser, potentially leading to data theft or session hijacking.

References