WordPress CVEs

Description

The Football Pool plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shouttext' parameter in all versions up to, and including, 2.13.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected script only fires in the admin Edit view for a shout; the public Shoutbox widget and the admin list view both encode output via Football_Pool_Utils::xssafe(), making the admin Edit view the sole unescaped sink.

Affected WordPress components

• Football Pool Plugin · football-pool
  Confirmed match Active
  Up to and including 2.13.5
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• antoineh Football Pool — Up to and including 2.13.5

References

• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/football-pool/tags/2.13.5/admin/class-football-pool-admin-shoutbox.php#L100
• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/football-pool/tags/2.13.5/admin/class-football-pool-admin.php#L654
• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/football-pool/tags/2.13.5/classes/class-football-pool-shoutbox.php#L57
• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/football-pool/tags/2.13.5/widgets/widget-football-pool-shoutbox.php#L84
• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset?reponame=&old=3775727%40football-pool&new=3775727%40football-pool
• www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/ac3e048d-9ebd-41c2-9dbd-751adae10380?source=cve
• nvd.nist.gov Official NVD record