CVE-2025-58987: Football Pool WordPress Plugin XSS Flaw

CVE-2025-58987 Overview

CVE-2025-58987 is a stored cross-site scripting (XSS) vulnerability in the AntoineH Football Pool plugin for WordPress. The flaw affects all versions up to and including 2.12.6. An authenticated attacker with low privileges can inject persistent JavaScript payloads that execute in the browsers of other users who view affected pages. The vulnerability is classified under CWE-79, Improper Neutralization of Input During Web Page Generation.

Critical Impact

Stored XSS enables session hijacking, credential theft, and administrative action forgery against WordPress users who load pages rendered by the vulnerable Football Pool plugin.

Affected Products

• AntoineH Football Pool WordPress plugin versions <= 2.12.6
• WordPress sites running the Football Pool plugin without the vendor patch
• Any WordPress installation permitting low-privileged authenticated users to submit input to the plugin

Discovery Timeline

• 2025-09-09 - CVE-2025-58987 published to the National Vulnerability Database
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58987

Vulnerability Analysis

The Football Pool plugin fails to properly neutralize user-supplied input before including it in generated web pages. An authenticated attacker submits crafted input containing HTML or JavaScript, which the plugin stores and later renders without adequate encoding. When any user loads the affected page, the injected script executes in that user's browser context, inheriting the victim's session and permissions.

Because the payload is stored server-side, exploitation persists across sessions and impacts every user who views the tainted content. The scope-change component in the vulnerability metrics reflects the ability of injected scripts to affect resources beyond the compromised component, such as the WordPress admin session.

Root Cause

The root cause is missing or insufficient output encoding of user-controlled data in one or more plugin views. WordPress provides sanitization helpers such as esc_html(), esc_attr(), and wp_kses(), but the affected plugin code paths do not apply them consistently before echoing stored input into HTML contexts.

Attack Vector

Exploitation requires network access to the WordPress site, low-privileged authentication, and user interaction to trigger the stored payload. An attacker with a contributor or subscriber-level account submits input containing a script payload through a form or field exposed by the Football Pool plugin. When an administrator or another user views the resulting page, the browser executes the attacker's script. Common outcomes include cookie theft, forced administrative actions via forged requests, redirection to phishing pages, and delivery of secondary payloads.

No verified proof-of-concept code has been published. Refer to the Patchstack advisory for additional technical context.

Detection Methods for CVE-2025-58987

Indicators of Compromise

• WordPress wp_posts or plugin-specific tables containing <script>, onerror=, onload=, or javascript: strings in user-submitted fields
• Unexpected outbound requests from browsers loading Football Pool pages to attacker-controlled domains
• New or modified administrator accounts created shortly after low-privileged users interacted with the plugin

Detection Strategies

• Audit plugin database tables for HTML tags and JavaScript event handlers embedded in text fields
• Enable WordPress access logging and inspect POST requests to Football Pool endpoints for suspicious payloads
• Deploy a web application firewall rule that flags HTML control characters submitted to plugin form handlers

Monitoring Recommendations

• Alert on Content Security Policy (CSP) violation reports originating from pages served by the plugin
• Correlate authenticated low-privileged user submissions with subsequent administrative session anomalies
• Track plugin version inventory across WordPress estates and flag any host still running 2.12.6 or earlier

How to Mitigate CVE-2025-58987

Immediate Actions Required

• Update the AntoineH Football Pool plugin to a version later than 2.12.6 once released by the vendor
• Restrict user registration and limit the roles permitted to submit input to the plugin
• Force password resets and invalidate active sessions for administrators who accessed affected pages

Patch Information

At the time of publication, the Patchstack advisory lists all versions through 2.12.6 as affected. Monitor the plugin's WordPress.org page and the Patchstack database for a fixed release, and apply it across all environments as soon as it becomes available.

Workarounds

• Deactivate and remove the Football Pool plugin until a patched version is available
• Deploy a Content Security Policy that blocks inline scripts and restricts script sources to trusted origins
• Place the WordPress site behind a web application firewall configured to filter XSS payloads on plugin routes

# Example CSP header to reduce stored XSS impact
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'