EUVD-2026-13990
GHSA-v4jm-pj3g-5pv4
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The Simple Football Scoreboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ytmr_fb_scoreboard' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
The Simple Football Scoreboard plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the 'ytmr_fb_scoreboard' shortcode due to insufficient input sanitization and output escaping of user-supplied attributes. All versions up to and including 1.0 are affected, allowing authenticated attackers with Contributor-level access or above to inject arbitrary JavaScript that executes for all users viewing the compromised page. With a CVSS score of 6.4 and network-based attack vector requiring only low privileges, this represents a moderate but exploitable threat to WordPress sites using this plugin.
Technical ContextAI
The vulnerability exists in the Simple Football Scoreboard plugin (vendor: Dogrow, identified via CPE cpe:2.3:a:dogrow:simple_football_scoreboard:*:*:*:*:*:*:*:*) and stems from CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Specifically, the shortcode handler at line 310 of ytmr_simple_football_scoreboard.php processes shortcode attributes directly without proper sanitization via functions like sanitize_text_field() or sanitize_url(), and fails to escape output using WordPress escaping functions such as esc_attr(), esc_html(), or wp_kses_post(). This allows malicious shortcode attributes to be rendered as executable JavaScript in the page DOM. The vulnerability is classified as Stored XSS because the malicious payload persists in the post or page content itself rather than being reflected in a URL parameter.
RemediationAI
The primary remediation is to disable and remove the Simple Football Scoreboard plugin immediately, as no patched version has been released by the vendor (Dogrow) and the plugin appears to be unmaintained as of version 1.0. For organizations requiring scoreboard functionality, migrate to actively maintained alternative plugins with proper security practices. As an interim measure if removal is not immediately feasible, restrict Contributor-level and above user roles to trusted administrators only, enforce strict capability checks, and monitor post/page content for suspicious shortcode modifications. Consider using WordPress security plugins such as Wordfence or Sucuri to detect and log shortcode attribute changes. Reference the Wordfence vulnerability advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/48c114d7-3d53-4157-a335-19cf4b47eed5?source=cve for detailed guidance and continued threat monitoring.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today