CVE-2025-53280

Vulnerability

Overview The Football Pool plugin for WordPress (versions up to and including 2.12.5) suffers from a Stored Cross-Site Scripting (XSS) vulnerability due to Improper Neutralization of Input During Web Page Generation [1]. This means user-supplied input is not properly sanitized before being stored and later displayed to other users, allowing arbitrary JavaScript or HTML to be embedded.

Exploitation

Conditions Exploitation requires a privileged user (e.g., an author or administrator) to interact with a crafted link or form; the attacker does not need direct access to the site. Once triggered, the malicious payload is stored on the server and executed whenever other users (including site visitors) access the affected page [1].

Impact

A successful attack can lead to the execution of arbitrary scripts in the context of the victim's browser. Common uses include redirecting users to malicious sites, displaying unauthorized advertisements, or stealing session cookies [1].

Mitigation

The vendor released version 2.12.6 which resolves the issue. Users are strongly advised to update immediately. For those unable to update, consulting a web developer or hosting provider is recommended [1].