The Football Pool plugin for WordPress contains a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Authenticated users with administrator-level permissions can inject arbitrary scripts via the plugin's admin settings. This vulnerability affects multi-site installations and installations where the unfiltered_html capability is disabled. The CVSS 3.1 base score is 5.5, reflecting a medium severity with network attack vector, low attack complexity, high privileges required, no user interaction, and impacts on confidentiality and integrity but not availability. There is no indication of known exploits in the wild or available patches at this time.

An attacker with administrator privileges on affected WordPress multi-site installations or those with unfiltered_html disabled can inject malicious scripts that execute in the context of users visiting the injected pages. This can lead to unauthorized disclosure of information and modification of data within the affected site. The vulnerability does not affect availability and requires high privileges, limiting the scope of exploitation to trusted users with admin access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted users only and consider disabling or removing the Football Pool plugin in multi-site environments or where unfiltered_html is disabled if possible. Monitor vendor channels for updates and apply patches promptly once available.