CVE-2026-118050

Name of the Vulnerable Software and Affected Versions Football Pool plugin for WordPress versions prior to 2.13.6

Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting. By manipulating the shouttext parameter, an attacker can inject arbitrary web scripts that execute when a user accesses the admin Edit view for a shout. While the public Shoutbox widget and admin list view use the Football Pool Utils::xssafe() function to encode output, the admin Edit view remains an unescaped sink.

Recommendations Update the plugin to version 2.13.6 or later. As a temporary mitigation, restrict access to the admin Edit view for shouts to trusted administrators only.