PatchSiren

antoineh CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM antoineh CVE published 2026-08-05

CVE-2026-8790

The Football Pool plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `shouttext` POST parameter of the Shoutbox widget in all versions up to, and including, 2.13.4. This is due to insufficient input sanitization and output escaping. When a shoutbox form submission fails the nonce check, the raw POST value is echoed back into a `<textarea>` element using `printf('%s', ...)` with n [truncated]