CVE-2026-8790

Name of the Vulnerable Software and Affected Versions Football Pool plugin for WordPress versions prior to 2.13.5

Description Reflected Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. When a shoutbox form submission fails the nonce check, the shouttext parameter is empty, or the user cannot save, the raw POST value is echoed back into a <textarea> element using the printf('%s', ...) function without HTML escaping. This allows unauthenticated attackers to execute arbitrary web scripts in the browser of an authenticated victim with Subscriber-level permissions or higher who is tricked into submitting a crafted POST request to a page containing the Shoutbox widget.

Recommendations Update the Football Pool plugin for WordPress to version 2.13.5 or later. As a temporary mitigation, restrict access to the Shoutbox widget or avoid using the shouttext parameter until the update is applied.