CVE-2026-8790: Football Pool <= 2.13.4 - Authenticated (Subscriber+) Reflected Cross-Site Scripting
The Football Pool plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the shouttext POST parameter of the Shoutbox widget in all versions up to, and including, 2.13.4 due to insufficient input sanitization and output escaping. When a shoutbox form submission fails the nonce check (or shouttext is empty, or the user is unable to save), the raw POST value is echoed back into a <textarea> element using printf('%s', ...) with no HTML escaping. This makes it possible for unauthenticated attackers to execute arbitrary web scripts in the browser of an authenticated victim (Subscriber-level or higher) who is tricked into submitting a crafted POST request to a page that contains the Shoutbox widget.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Football Pool (WordPress plugin)to a version that resolves this vulnerability.Fixed in 2.13.4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8790?
CVE-2026-8790 has a medium severity rating of 6.1.
How do I fix CVE-2026-8790?
To fix CVE-2026-8790, update the Football Pool plugin to version 2.13.5 or later to ensure proper input sanitization.
What type of vulnerability is CVE-2026-8790?
CVE-2026-8790 is classified as an Authenticated Reflected Cross-Site Scripting (XSS) vulnerability.
Which versions of the Football Pool plugin are affected by CVE-2026-8790?
CVE-2026-8790 affects all versions of the Football Pool plugin for WordPress up to and including 2.13.4.
What causes the vulnerability in CVE-2026-8790?
CVE-2026-8790 is caused by insufficient input sanitization and output escaping in the `shouttext` POST parameter.