The Football Pool plugin includes a Shoutbox widget that echoes the value of the POST parameter 'shouttext' back into a textarea without any HTML escaping when the nonce check fails or the input is empty. This insufficient sanitization creates a reflected XSS vulnerability. An attacker who can craft a malicious POST request to a page containing the Shoutbox widget can have the victim’s browser execute injected JavaScript, enabling cookie theft, defacement, or session hijacking in the context of the victim’s logged‑in session.

The vulnerability is present in all releases of the Football Pool plugin for WordPress up to and including version 2.13.4. Any WordPress site that has installed this plugin and a user is logged in with a Subscriber or higher role is potentially affected.

The CVSS score of 6.1 indicates a moderate severity. EPSS data is not available, and the vulnerability is not currently listed in CISA’s KEV catalog. Exploitability requires an unauthenticated attacker to target a legitimate site with the Shoutbox widget and persuade an authenticated Subscriber‑level user to submit a crafted POST request containing malicious code. Because the code path is reflected directly into the page, successful exploitation can lead to credential theft or execution of arbitrary scripts in the victim’s browser, impacting confidentiality, integrity, and availability of the site for that user.