CVE-2025-58987

Vulnerability

The Football Pool plugin for WordPress, up to version 2.12.6, contains a stored Cross-Site Scripting (XSS) vulnerability [1]. This improper neutralization of user input during web page generation allows attackers to inject arbitrary HTML and JavaScript into the site's pages [1].

Exploitation

The vulnerability is initiated by a user with the required privilege level, but successful exploitation also requires user interaction — for example, clicking a link or visiting a crafted page [1]. This makes it a medium-severity issue (CVSS 6.5) [1]. Attackers can leverage this in mass-exploit campaigns targeting thousands of websites regardless of size or popularity [1].

Impact

If exploited, the injected scripts can execute when visitors access the affected site, enabling actions such as redirects, display of advertisements, or other malicious HTML payloads [1]. This could compromise user trust and site integrity.

Mitigation

The vulnerability is addressed in version 2.13.0 [1]. Users are advised to update immediately. For sites unable to update, contacting a hosting provider or web developer for assistance is recommended [1]. Patchstack users can enable auto-updates for vulnerable plugins [1].