CVE-2026-8790

The Football Pool plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `shouttext` POST parameter of the Shoutbox widget in all versions up to, and including, 2.13.4 due to insufficient input sanitization and output escaping. When a shoutbox form submission fails the nonce check (or `shouttext` is empty, or the user is unable to save), the raw POST value is echoed back into a `<textarea>` element using `printf('%s', ...)` with no HTML escaping. This makes it possible for unauthenticated attackers to execute arbitrary web scripts in the browser of an authenticated victim (Subscriber-level or higher) who is tricked into submitting a crafted POST request to a page that contains the Shoutbox widget.

• CWE-79

• https://plugins.trac.wordpress.org/browser/football-pool/tags/2.13.4/widgets/widget-football-pool-shoutbox.php#L127
• https://plugins.trac.wordpress.org/browser/football-pool/tags/2.13.4/widgets/widget-football-pool-shoutbox.php#L142
• https://plugins.trac.wordpress.org/browser/football-pool/tags/2.13.4/widgets/widget-football-pool-shoutbox.php#L84
• https://plugins.trac.wordpress.org/browser/football-pool/trunk/widgets/widget-football-pool-shoutbox.php#L127
• https://plugins.trac.wordpress.org/browser/football-pool/trunk/widgets/widget-football-pool-shoutbox.php#L142
• https://plugins.trac.wordpress.org/browser/football-pool/trunk/widgets/widget-football-pool-shoutbox.php#L84
• https://plugins.trac.wordpress.org/changeset/3538628/football-pool/trunk/widgets/widget-football-pool-shoutbox.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/c5d17538-30ff-423c-bd61-d85a3f5aba74?source=cve

Published

Aug 5, 2026

Last Modified

Aug 12, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-8784A vulnerability was detected in npitre cramfs-tools up to 2.…4.2
• CVE-2026-8785A flaw has been found in projectworlds hospital-management-s…7.3
• CVE-2026-8786A vulnerability has been found in Tencent WeKnora up to 0.3.…6.3
• CVE-2026-8787The Firebase Support & Chat Management plugin for WordPress …8.8
• CVE-2026-8788Net::Statsd::Lite versions through 0.10.0 for Perl allowed m…7.3
• CVE-2026-8789The Easy Appointments plugin for WordPress is vulnerable to …8.1
• CVE-2026-8791The Booking System Trafft plugin for WordPress is vulnerable…6.4
• CVE-2026-8793PaperCut NG/MF does not properly restrict excessive authenti…6.9
• CVE-2026-8794PaperCut NG/MF contains an observable timing discrepancy in …6.9
• CVE-2026-8795A YAML injection vulnerability exists in the Windows.Collect…7.8
• CVE-2026-8796Sereal::Decoder versions before 5.005 for Perl allow heap ou…8.1
• CVE-2026-8797An access control deficiency vulnerability exists in Express…8.5