Whitesector

**Name of the Vulnerable Software and Affected Versions** Football Pool plugin for WordPress versions prior to 2.13.5 **Description** Reflected Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. When a shoutbox form submission fails the nonce check, the `shouttext` parameter is empty, or the user cannot save, the raw POST value is echoed back into a `<textarea>` element using the `printf('%s', ...)` function without HTML escaping. This allows unauthenticated attackers to execute arbitrary web scripts in the browser of an authenticated victim with Subscriber-level permissions or higher who is tricked into submitting a crafted POST request to a page containing the Shoutbox widget. **Recommendations** Update the Football Pool plugin for WordPress to version 2.13.5 or later. As a temporary mitigation, restrict access to the Shoutbox widget or avoid using the `shouttext` parameter until the update is applied.