CVE-2026-8790 is a reflected cross-site scripting vulnerability in the Football Pool WordPress plugin's Shoutbox widget. The issue is due to improper neutralization of input during web page generation, specifically insufficient input sanitization and output escaping of the 'shouttext' POST parameter. When a shoutbox form submission fails the nonce check, or the input is empty, the raw POST value is output directly into a textarea element using printf('%s', ...) without HTML escaping. This flaw enables unauthenticated attackers to execute arbitrary JavaScript in the context of authenticated users who submit crafted POST requests to pages containing the Shoutbox widget. The vulnerability affects all versions up to and including 2.13.4.

An attacker can exploit this vulnerability to execute arbitrary scripts in the browsers of authenticated users with Subscriber-level or higher privileges. This can lead to session hijacking, unauthorized actions performed on behalf of the user, or other client-side impacts. The vulnerability does not require authentication to trigger but relies on an authenticated victim submitting a crafted POST request. The CVSS 3.1 base score is 6.1 (medium severity), reflecting network attack vector, low attack complexity, no privileges required by the attacker, but requiring user interaction and resulting in partial confidentiality and integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch link is provided in the available data. Until a patch is available, users should consider disabling the Shoutbox widget or restricting access to trusted users only. Additionally, monitoring for suspicious POST requests targeting the 'shouttext' parameter may help detect exploitation attempts.