World Cup Predictor
World Cup Predictor has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it remains unpatched as of September 2026. Their average CVSS score is 6.1, and the most serious one scores 6.1 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for World Cup Predictor has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.
All of these findings were reported by Le Ngoc Anh. World Cup Predictor is installed on roughly 100 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.
CVE-2025-22794World Cup Predictor <= 1.9.6 - Reflected Cross-Site Scripting
Read the full analysisVulnerability Records
World Cup Predictor
Author
ianhaycox
World Cup Predictor is a free WordPress plugin that allows you to create prediction games for football tournaments like the FIFA World Cup. Engage your audience, increase interaction and let users compete by predicting match results, group standings and knockout stages. 🎯 Perfect for: – Football websites and blogs – Tipsters and betting communities – Fan engagement campaigns – World Cup events and promotions 🔥 Live Demo: https://wcp.net.br/predictions Features ✔ Match predictions system ✔ Automatic group tables ✔ Knockout stage simulation ✔ User rankings and scoring ✔ Easy integration with any WordPress theme ✔ Works with World Cup 2026 (48 teams format) How it works Install and activate the plugin Import teams, venues and matches Create prediction pages automatically Let users submit their predictions Track rankings and results Support If you enjoy the plugin or want to support its development: https://wcp.net.br/why-your-support-matters
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C