Football Pool
Monthly
Reflected Cross-Site Scripting in the Football Pool WordPress plugin (all versions ≤ 2.13.4) allows unauthenticated attackers to inject arbitrary JavaScript into the browsers of authenticated WordPress subscribers via the Shoutbox widget's `shouttext` POST parameter. The flaw is triggered when a shoutbox submission fails validation - nonce mismatch, empty input, or save failure - causing the raw POST value to be echoed unescaped into a `<textarea>` via `printf('%s', ...)`. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but a remediation commit (changeset 3538628) has been pushed to the plugin trunk.
Stored cross-site scripting (XSS) in the Football Pool WordPress plugin up to version 2.12.4 allows authenticated administrators to inject arbitrary web scripts via admin settings. This affects only multi-site installations or those where unfiltered_html is disabled. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Reflected Cross-Site Scripting in the Football Pool WordPress plugin (all versions ≤ 2.13.4) allows unauthenticated attackers to inject arbitrary JavaScript into the browsers of authenticated WordPress subscribers via the Shoutbox widget's `shouttext` POST parameter. The flaw is triggered when a shoutbox submission fails validation - nonce mismatch, empty input, or save failure - causing the raw POST value to be echoed unescaped into a `<textarea>` via `printf('%s', ...)`. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but a remediation commit (changeset 3538628) has been pushed to the plugin trunk.
Stored cross-site scripting (XSS) in the Football Pool WordPress plugin up to version 2.12.4 allows authenticated administrators to inject arbitrary web scripts via admin settings. This affects only multi-site installations or those where unfiltered_html is disabled. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).