AntoineH vulnerabilities and threats

The Football Pool plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'shouttext' parameter affecting all versions up to and including 2.13.5. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute in the admin Edit view for a shout. Other views such as the public Shoutbox widget and admin list view properly escape output, limiting the impact to the admin Edit interface.

The Football Pool plugin for WordPress contains a reflected cross-site scripting (XSS) vulnerability in the Shoutbox widget. This occurs via the 'shouttext' POST parameter in all versions up to and including 2.13.4. The vulnerability arises because raw POST data is echoed back into a textarea element without proper HTML escaping when certain conditions fail, such as nonce check failure or empty input. This allows unauthenticated attackers to execute arbitrary scripts in the browsers of authenticated users with Subscriber-level or higher privileges who submit crafted POST requests.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AntoineH Football Pool football-pool allows Stored XSS.This issue affects Football Pool: from n/a through <= 2.12.6.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AntoineH Football Pool football-pool allows Stored XSS.This issue affects Football Pool: from n/a through <= 2.12.5.

The Football Pool plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.12.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Cross-Site Request Forgery (CSRF) vulnerability in AntoineH Football Pool football-pool allows Cross Site Request Forgery.This issue affects Football Pool: from n/a through <= 2.12.2.