CVE-2026-8790 is a reflected cross-site scripting vulnerability in the Football Pool WordPress plugin's Shoutbox widget. The flaw exists because the shouttext POST parameter is echoed back into a textarea element using printf('%s', ...) without HTML escaping when the form submission fails nonce checks or other validation. This allows an unauthenticated attacker to execute arbitrary JavaScript in the context of an authenticated user (Subscriber-level or higher) who submits a crafted POST request to a page containing the Shoutbox widget. The vulnerability affects all versions up to and including 2.13.4.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the browser of an authenticated user with Subscriber-level or higher privileges. This can lead to theft of user credentials, session tokens, or other sensitive information accessible to the victim's browser context. The vulnerability does not impact availability but compromises confidentiality and integrity of user sessions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling the Shoutbox widget or restricting access to trusted users only. Avoid submitting untrusted input to the shouttext parameter. Monitor vendor channels for official patches or updates addressing this issue.