CVE-2026-8790

Football Pool <= 2.13.4 - Authenticated (Subscriber+) Reflected Cross-Site Scripting

2026-08-04 16:20
whitesector

Strategic Overview

Status
Patched in 2.13.5
Affected Plugin
Football Pool
Affected Version
<= 2.13.4
CVSS
6.1Medium
Weakness type
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE
CVE-2026-8790
View all Football Pool vulnerabilities

At a glance

CVE-2026-8790 is a medium-severity Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Football Pool WordPress plugin, affecting versions <= 2.13.4. It carries a CVSS score of 6.1 (reachable over the network; low attack complexity). Exploitation requires no authentication. The issue is fixed in version 2.13.5; sites on affected versions should update now. Disclosed August 2026, reported by whitesector.

Vulnerability Overview

The Football Pool plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `shouttext` POST parameter of the Shoutbox widget in all versions up to, and including, 2.13.4 due to insufficient input sanitization and output escaping. When a shoutbox form submission fails the nonce check (or `shouttext` is empty, or the user is unable to save), the raw POST value is echoed back into a `<textarea>` element using `printf('%s', ...)` with no HTML escaping. This makes it possible for unauthenticated attackers to execute arbitrary web scripts in the browser of an authenticated victim (Subscriber-level or higher) who is tricked into submitting a crafted POST request to a page that contains the Shoutbox widget.

Technical Analysis

The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no privileges on the target site.

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Reaching this weakness in Football Pool <= 2.13.4 takes an account at Subscriber level or above. Cross-site scripting happens when input from a request is written into a page without being escaped for the context it lands in, so the browser parses attacker-supplied text as markup or script.

Injected script runs with the privileges of whoever views the affected page, which is how these flaws turn into administrator session theft, silent account creation or persistent backdoors in page content. For Football Pool the fix is 2.13.5: builds <= 2.13.4 are affected, anything from 2.13.5 onward is not.

Remediation

Update to version 2.13.5, or a newer patched version

How WordSec helps

An attacker needs Subscriber access first, so the firewall sees the attempt as traffic from a logged-in account: WordSec's web application firewall inspects request payloads before WordPress loads them. None of that substitutes for the fix: Football Pool 2.13.5 closes this, and updating the plugin is the step that ends it.

  • Firewall
  • Alerts

External References

https://www.cve.org/CVERecord?id=CVE-2026-8790https://www.wordfence.com/threat-intel/vulnerabilities/id/c5d17538-30ff-423c-bd61-d85a3f5aba74https://nvd.nist.gov/vuln/detail/CVE-2026-8790

Related records

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C