CVE-2026-8790 antoineh CVE debrief

Who should care

Administrators of WordPress installations with the Football Pool plugin, security teams monitoring for XSS attacks, and users of the affected plugin should prioritize patching or mitigating this vulnerability. The vulnerability's impact is limited to reflected XSS attacks, but it could still have significant consequences if exploited. Affected operators should review their installations and ensure that the plugin is updated or removed. Vulnerability management and security teams should monitor for suspicious activity and implement compensating controls such as Web Application Firewalls.

Technical summary

The Football Pool plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `shouttext` POST parameter of the Shoutbox widget in all versions up to, and including, 2.13.4. This is due to insufficient input sanitization and output escaping. When a shoutbox form submission fails the nonce check, the raw POST value is echoed back into a `<textarea>` element using `printf('%s', ...)` with no HTML escaping. This makes it possible for unauthenticated attackers to execute arbitrary web scripts in the browser of an authenticated victim (Subscriber-level or higher) who is tricked into submitting a crafted POST request to a page that contains the Shoutbox widget. The vulnerability has a CVSS score of 6.1 and is classified as MEDIUM severity.

Defensive priority

Medium priority due to CVSS score of 6.1 and potential for reflected XSS attacks

Recommended defensive actions

• Inventory and verify the Football Pool plugin version
• Apply vendor patch or upgrade to a fixed version
• Implement compensating controls such as Web Application Firewalls
• Monitor for suspicious activity and exception tracking
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The Football Pool plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `shouttext` POST parameter of the Shoutbox widget. Insufficient input sanitization and output escaping allow unauthenticated attackers to execute arbitrary web scripts in the browser of an authenticated victim. Evidence is limited to public sources and may not reflect the full scope of affected systems. Defenders should verify the presence of the Shoutbox widget and review logs for suspicious activity.

Official resources