EUVD-2026-53040
GHSA-jq74-qc6v-q6x5
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-delivered reflected XSS with no attacker privileges; scope changes because script runs in victim's authenticated browser; UI:R required to trick victim into submitting crafted POST.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
The Football Pool plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the shouttext POST parameter of the Shoutbox widget in all versions up to, and including, 2.13.4 due to insufficient input sanitization and output escaping. When a shoutbox form submission fails the nonce check (or shouttext is empty, or the user is unable to save), the raw POST value is echoed back into a <textarea> element using printf('%s', ...) with no HTML escaping. This makes it possible for unauthenticated attackers to execute arbitrary web scripts in the browser of an authenticated victim (Subscriber-level or higher) who is tricked into submitting a crafted POST request to a page that contains the Shoutbox widget.
AnalysisAI
Reflected Cross-Site Scripting in the Football Pool WordPress plugin (all versions ≤ 2.13.4) allows unauthenticated attackers to inject arbitrary JavaScript into the browsers of authenticated WordPress subscribers via the Shoutbox widget's shouttext POST parameter. The flaw is triggered when a shoutbox submission fails validation - nonce mismatch, empty input, or save failure - causing the raw POST value to be echoed unescaped into a <textarea> via printf('%s', ...). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The Football Pool plugin must be installed and active on the WordPress site, and the Shoutbox widget must be placed on at least one publicly accessible page. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.1 Medium score (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) accurately reflects the balanced risk profile: the attacker requires no authentication and faces low complexity, but exploitation depends on social engineering a logged-in Subscriber-level (or higher) WordPress user into submitting a crafted POST request. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a POST request to a Football Pool Shoutbox widget page with a malicious `shouttext` value containing a script payload designed to close the `<textarea>` tag and inject JavaScript. The attacker then uses phishing - a link, email, or embedded iframe - to cause a logged-in WordPress subscriber to submit this request, for example by hosting a page with an auto-submitting HTML form. … |
| Remediation | A remediation commit has been pushed to the plugin's trunk (WordPress Trac changeset 3538628 at https://plugins.trac.wordpress.org/changeset/3538628/football-pool/trunk/widgets/widget-football-pool-shoutbox.php); however, a specific released patched version number has not been independently confirmed from the available data - update to the latest available version from the WordPress Plugin Directory and verify the version exceeds 2.13.4. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Football Pool
View allSame weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today