plugin
20 known security issues reported for the Football Pool WordPress plugin. Most recent disclosed Aug 4, 2026.
Running Football Pool on your site? Check whether your installed version is affected.
Scan your site freeThe Football Pool plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `shouttext` POST parameter of the Shoutbox widget in all versions up to, and including, 2.13.4 due to insufficient input sanitization and output escaping. When a shoutbox form submission fails the nonce check (or `shouttext`...
The Football Pool plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.12.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages t...
[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AntoineH Football Pool allows Stored XSS. This issue affects Football Pool: from n/a through 2.12.6.
The Football Pool plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.12.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages t...
[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AntoineH Football Pool allows Stored XSS. This issue affects Football Pool: from n/a through 2.12.5.
The Football Pool plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.12.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject ar...
[en] Cross-Site Request Forgery (CSRF) vulnerability in AntoineH Football Pool allows Cross Site Request Forgery. This issue affects Football Pool: from n/a through 2.12.2.
The Football Pool plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.12.2. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update the plugin's settings granted they can trick a site administ...
[en] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Antoine Hurkmans Football Pool allows Stored XSS.This issue affects Football Pool: from n/a through 2.11.10.
[en] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Antoine Hurkmans Football Pool allows Stored XSS.This issue affects Football Pool: from n/a through 2.11.9.
The Football Pool plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'answer' parameter in versions up to, and including, 2.11.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitr...
The Football Pool plugin for WordPress is vulnerable to Stored Cross-Site Scripting via settings in all versions up to, and including, 2.11.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and above, to inject arbitrary web...
[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Antoine Hurkmans Football Pool allows Stored XSS.This issue affects Football Pool: from n/a through 2.11.3.
The Football Pool plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 2.11.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level...
The Football Pool plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 2.11.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level...
Update the WordPress Football Pool plugin to the latest available version (at least 2.11.4). WordFence discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Football Pool Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTM...
[en] The football-pool plugin before 2.6.5 for WordPress has multiple XSS issues.
The football-pool plugin before 2.6.5 for WordPress has multiple XSS issues.
WordPress Football Pool Plugin Authenticated Arbitrary File Upload Vulnerability was found in 2.6.3 version. The function didn’t include any restriction on what type of files can be uploaded Update the plugin.
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free