CVE-2026-8790: Football Pool Plugin XSS Vulnerability

CVE-2026-8790 Overview

CVE-2026-8790 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Football Pool plugin for WordPress. The flaw affects all versions up to and including 2.13.4. The shouttext POST parameter of the Shoutbox widget is echoed back into a <textarea> element without HTML escaping when a submission fails validation. Unauthenticated attackers can craft malicious POST requests that execute arbitrary JavaScript in the browser of an authenticated victim (Subscriber-level or higher) who is tricked into interacting with the attacker-supplied content. The vulnerability is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Successful exploitation allows arbitrary script execution in the victim's browser session, enabling session theft, redirection, or actions performed on behalf of the authenticated user.

Affected Products

Football Pool plugin for WordPress
All versions up to and including 2.13.4
WordPress sites hosting pages that render the Shoutbox widget

Discovery Timeline

2026-08-05 - CVE-2026-8790 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-8790

Vulnerability Analysis

The Football Pool plugin exposes a Shoutbox widget that accepts user shout submissions through a POST request. When the submission handler in widget-football-pool-shoutbox.php encounters a failure condition, it re-renders the form and populates the <textarea> with the previously submitted value. The re-rendering uses printf('%s', ...) against the raw POST value, bypassing WordPress helpers such as esc_textarea() or esc_html(). Any HTML or JavaScript payload supplied in shouttext is written verbatim into the DOM.

Because the vulnerable code path executes on failed nonce checks, empty submissions, or when the user lacks save permissions, an unauthenticated attacker can reliably reach the reflection sink. The attacker crafts a URL or auto-submitting form that posts a malicious shouttext value to a page containing the Shoutbox widget. When a logged-in Subscriber (or higher) triggers the request, the reflected payload executes in their session context.

Root Cause

The root cause is insufficient input sanitization and output escaping. The plugin trusts POST-supplied data during error-path rendering and writes it directly into HTML using printf('%s', $_POST['shouttext']). WordPress provides context-aware escaping functions specifically for <textarea> content, but the plugin does not apply them at this sink.

Attack Vector

Exploitation requires user interaction. An attacker hosts or delivers a crafted page that submits a POST request to a WordPress page containing the Shoutbox widget, with shouttext set to a payload such as </textarea><script>...</script>. Once the victim is redirected or tricked into submitting the request while authenticated, the script executes in their browser under the site's origin. The scope is changed because the executed script can act across the WordPress session boundary.

See the Wordfence Vulnerability Report and the vulnerable code paths at line 84, line 127, and line 142 for technical details.

Detection Methods for CVE-2026-8790

Indicators of Compromise

POST requests to pages hosting the Shoutbox widget containing HTML control characters such as </textarea>, <script>, onerror=, or javascript: in the shouttext parameter.
HTTP referrers originating from external domains for POST submissions targeting the Shoutbox widget.
Server access logs showing repeated failed nonce submissions followed by successful renders of the shoutbox page.

Detection Strategies

Inspect web server and WordPress logs for POST bodies containing script tags or HTML-breaking sequences in the shouttext field.
Deploy a Web Application Firewall (WAF) rule that blocks or alerts on XSS signatures in POST parameters targeting the Football Pool plugin endpoints.
Monitor for anomalous outbound requests from authenticated WordPress user sessions that could indicate cookie exfiltration.

Monitoring Recommendations

Track the installed version of the Football Pool plugin across managed WordPress sites and alert on versions <= 2.13.4.
Enable Content Security Policy (CSP) reporting to detect inline script execution originating from unexpected sources.
Review Wordfence or equivalent plugin logs for signatures associated with reflected XSS attempts.

How to Mitigate CVE-2026-8790

Immediate Actions Required

Update the Football Pool plugin to a version newer than 2.13.4 once a patched release is available from the vendor.
If a fixed version is not yet installed, deactivate the Football Pool plugin or remove the Shoutbox widget from all public pages.
Educate administrators and privileged users about the risk of interacting with untrusted links while logged in to the WordPress site.

Patch Information

A vendor code change has been committed to the plugin trunk. Review the WordPress Changeset Update for the specific modifications applied to widget-football-pool-shoutbox.php. Site operators should upgrade to the first tagged release that incorporates this changeset.

Workarounds

Remove the Shoutbox widget from all pages until the plugin is upgraded to a patched release.
Deploy a WAF rule that strips or blocks HTML markup and script content in the shouttext POST parameter.
Restrict site access to authenticated users only, or require higher privilege roles, to reduce the pool of potential victims.

bash

# Example WP-CLI commands to identify and disable the vulnerable plugin
wp plugin get football-pool --field=version
wp plugin deactivate football-pool