XSS in Antoineh Football Pool
CVE-2026-118050
The Football Pool plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shouttext' parameter in all versions up to, and including, 2.13.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected script only fires in the admin Edit view for a shout; the public Shoutbox widget and the admin list view both encode output via Football_Pool_Utils::xssafe(), making the admin Edit view the sole unescaped sink.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
- plugins.trac.wordpress.org/browser/football-pool/tags/2.13.5/admin/class-footba…
- plugins.trac.wordpress.org/browser/football-pool/tags/2.13.5/admin/class-footba…
- plugins.trac.wordpress.org/browser/football-pool/tags/2.13.5/classes/class-foot…
- plugins.trac.wordpress.org/browser/football-pool/tags/2.13.5/widgets/widget-foo…
- plugins.trac.wordpress.org/changeset
- www.wordfence.com/threat-intel/vulnerabilities/id/ac3e048d-9ebd-41c2-9dbd-751ad…
Frequently asked questions
- What is CVE-2026-118050?
- CVE-2026-118050 is a medium-severity vulnerability in Antoineh Football Pool, classified under Cross-site Scripting. CVSS score: 6.4/10. Published 2026-11-07.
- How severe is CVE-2026-118050?
- Medium severity. CVSS v3 base score is 6.4 out of 10.