The Football Pool plugin for WordPress has a stored cross‑site scripting flaw that allows any authenticated user with administrative or higher privileges to insert arbitrary JavaScript via the plugin’s admin settings. Because the input is not properly sanitized or escaped, the injected script runs whenever a page containing the stored data is viewed by any user. This can enable session hijacking, credential theft, or defacement of the site. The weakness is a classic input validation failure (CWE‑79).

All installations of the Football Pool plugin from any version up to and including 2.12.4, for which the WordPress installation is a multi‑site network and the unfiltered_html capability is disabled. The affected product is the WordPress plugin Football Pool published by the vendor antoineh.

The CVSS score of 5.5 indicates a moderate severity. The EPSS score is below 1 %, suggesting that widespread exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog. An attacker must first authenticate as an administrator or higher level and then use the plugin’s configuration interface to inject the malicious payload. Once injected, the payload will execute for all users who view the affected page, giving the attacker the same access rights as those users. The likely attack vector is the administrative panel of the plugin, and the condition of a multi‑site WordPress environment with unfiltered_html disabled is required for exploitation.