What is the CVSS score of CVE-2025-5490?

CVE-2025-5490 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Football Pool are affected by CVE-2025-5490?

Organizations using Football Pool should be aware of moderate risk from CVE-2025-5490, a cross-site scripting vulnerability rated CVSS 5.5.

How to fix or mitigate CVE-2025-5490?

Within 30 days: Identify affected systems running for WordPress is vulnerable to Stored Cross-Site Scripting v and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

Football Pool CVE-2025-5490

EUVD-2025-28575 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-06-19 security@wordfence.com

WordPress XSS Football Pool Wordpress Plugin Antoineh

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

5.5 MEDIUM

High privileges required, network vector, low complexity, scope change.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 13:25 vuln.today

EUVD ID Assigned

Mar 15, 2026 - 00:08 euvd

EUVD-2025-28575

CVE Published

Jun 19, 2025 - 06:15 nvd

MEDIUM 5.5

DescriptionCVE.org

The Football Pool plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.12.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

AnalysisAI

Stored cross-site scripting (XSS) in the Football Pool WordPress plugin up to version 2.12.4 allows authenticated administrators to inject arbitrary web scripts via admin settings. This affects only multi-site installations or those where unfiltered_html is disabled. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).

Technical ContextAI

The vulnerability is a stored XSS (CWE-79) in the Football Pool plugin for WordPress. The plugin allows administrators to configure settings that are not properly sanitized or escaped, enabling injection of malicious scripts. The CPE indicates the affected product is antoineh:football_pool for WordPress. The root cause is insufficient input sanitization and output escaping in admin settings.

RemediationAI

Update the Football Pool plugin to version 2.12.5 or later. The fix is available in the WordPress plugin repository: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3313611%40football-pool&new=3313611%40football-pool&sfp_email=&sfph_mail=. For multi-site installations, ensure unfiltered_html is enabled for trusted administrators. No workarounds are available; upgrading is the only remediation.