Football Pool

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:antoineh:football_pool:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorAntoineh (edcd07da-75d5-5e3b-b9a4-1b62e68ed1c3)
ProductFootball Pool (0e50624a-bc82-5819-b879-e0dd3a0e11a2)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from gcve-enriched-dumps CVE data

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2026-8790 vulnerable 2026-09-16 04:32:57.619945 Football Pool <= 2.13.4 - Authenticated (Subscriber+) Reflected Cross-Site Scripting
MEDIUM (6.1)
The Football Pool plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `shouttext` POST parameter of the Shoutbox widget in all versions up to, and including, 2.13.4 due to insufficient input sanitization and output escaping. When a shoutbox form submission fails the nonce check (or `shouttext` is empty, or the user is unable to save), the raw POST value is echoed back into a `<textarea>` element using `printf('%s', ...)` with no HTML escaping. This makes it possible for unauthenticated attackers to execute arbitrary web scripts in the browser of an authenticated victim (Subscriber-level or higher) who is tricked into submitting a crafted POST request to a page that contains the Shoutbox widget.
Published: 2026-08-05T04:25:26.540Z
Updated: 2026-08-05T16:19:40.108Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-5490 vulnerable 2026-06-08 07:37:24.938454 Football Pool <= 2.12.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
MEDIUM (5.5)
The Football Pool plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.12.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Published: 2025-06-19T05:26:56.567Z
Updated: 2026-04-08T16:37:13.743Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-58987 vulnerable 2026-06-08 07:35:19.853874 WordPress Football Pool Plugin <= 2.12.6 - Cross Site Scripting (XSS) Vulnerability
MEDIUM (6.5)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AntoineH Football Pool football-pool allows Stored XSS.This issue affects Football Pool: from n/a through <= 2.12.6.
Published: 2025-09-09T16:33:11.940Z
Updated: 2026-04-28T16:13:50.845Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-53280 vulnerable 2026-06-08 07:31:14.348134 WordPress Football Pool plugin <= 2.12.5 - Cross Site Scripting (XSS) Vulnerability
MEDIUM (6.5)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AntoineH Football Pool football-pool allows Stored XSS.This issue affects Football Pool: from n/a through <= 2.12.5.
Published: 2025-06-27T13:21:20.119Z
Updated: 2026-04-28T16:13:22.855Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-30764 vulnerable 2026-06-08 07:17:01.777779 WordPress Football Pool plugin <= 2.12.2 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability
MEDIUM (4.3)
Cross-Site Request Forgery (CSRF) vulnerability in AntoineH Football Pool football-pool allows Cross Site Request Forgery.This issue affects Football Pool: from n/a through <= 2.12.2.
Published: 2025-03-27T10:54:34.687Z
Updated: 2026-04-28T16:11:56.712Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.