The vulnerability is a classic stored XSS flaw caused by improper neutralization of input during web page generation. It allows an attacker to inject and persist malicious JavaScript that will run in the browser of any user who views the affected content. The weakness corresponds to CWE‑79 and can compromise the confidentiality, integrity, and availability of user data by enabling phishing, cookie theft, or manipulation of site content.

Vendors: AntoineH; Product: Football Pool plugin for WordPress. Vulnerable versions are all releases up through 2.12.5, meaning any installation of 2.12.5 or earlier is affected.

The CVSS score of 6.5 indicates a moderate impact. The EPSS score of less than 1% suggests the vulnerability is not widely exploited at the time of this analysis, and it is not listed in the CISA KEV catalog. Attackers would need the ability to submit content or otherwise influence the plugin’s stored data, typically requiring authenticated access or privilege escalation. Once the malicious code is stored, any user who views the affected content will have the script executed within their browser, potentially leading to phishing or credential theft.