The Football Pool plugin for WordPress is affected by a stored cross‑site scripting flaw that allows authenticated users with subscriber‑level permissions or higher to inject arbitrary JavaScript into shoutbox messages. The vulnerability resides in the ‘shouttext’ parameter, which is not properly sanitized or escaped before being rendered in the admin Edit view for a shout. Because the public Shoutbox widget and admin list view apply escaping with Football_Pool_Utils::xssafe(), only the edit interface presents an unescaped sink. An attacker who can inject script into this view can execute code in the context of any WordPress administrator who subsequently opens that edit page, potentially compromising the administrator’s session or facilitating further privilege escalation. This flaw maps directly to CWE‑79, reflecting a classic stored XSS weakness.

The issue affects the Football Pool plugin developed by antoineh, with all releases up to and including version 2.13.5. Any WordPress site running this plugin and exposing shoutbox editing capabilities to subscriber or higher‑level users is vulnerable.

The CVSS score for this vulnerability is 6.4, indicating a moderate severity. No EPSS score is available, and the flaw is not listed in CISA’s KEV catalog. Exploitation requires authenticated access; the attacker must be able to submit a shoutbox message as a subscriber or higher and later cause a site administrator to open the edit page for that message. Because the injected script only executes in the admin Edit view, the danger is contained to users with administrative privileges, though a compromised administrator can use the injected code to hijack sessions, deface content, or exfiltrate data.