CVE-2025-5490
Published
CVSS v3
5.5
MEDIUM
CVSS v2
N/A
Affected
1
PROJECT
Description
The Football Pool plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.12.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
<p>This plugin adds a fantasy sports pool to your blog. Visitors of your website can predict outcomes of matches and earn extra points with bonus questions. Every player can view scores and charts of the other pool contenders.</p>
<p>The plugin installs some custom tables in the database and includes match information for the UEFA 2024 Championship, but it can be easily updated with match info for other championships or sports. <em>Note</em>: deactivating the plugin may delete all plugin data from your database. To avoid this, make sure the “keep data on uninstall” option is enabled in the settings (it’s on by default since version 2.3.1).</p>
<p>I originally coded this pool in PHP as a standalone website for the UEFA 2000 championship and rewrote it several times for every European Championship and World Cup since. I kept adding features every year. In 2012, I turned it into a WordPress plugin and uploaded it to the plugin directory. I hope you enjoy it.</p>
<p>A special thank you to everyone who donated, helped translate, reported bugs, or contributed in any other way to improving the plugin!</p>
<p><strong>Features</strong></p>
<ul>
<li>Users can predict match outcomes.</li>
<li>Automatic calculation of the pool ranking, or define a custom ranking for a group of matches.</li>
<li>You can add bonus questions for extra fun (single answer and multiple choice).</li>
<li>Add your own teams and match data for other competitions.</li>
<li>Import or export game schedules.</li>
<li>Automatically calculate championship standings.</li>
<li>Flexible scoring options.</li>
<li>Built-in pages and shortcodes to display the pool on your blog.</li>
<li>Optional user leagues.</li>
<li>Score charts showing player progress and comparisons (requires separate Highcharts API download).</li>
<li>Widgets and shortcodes to display match and pool info.</li>
<li>Extra info pages for venues and teams.</li>
<li>Add custom functionality with filters and actions.</li>
<li>WP-CLI support for ranking calculations (faster than admin-side calculations).</li>
<li>WP-CLI support for importing match results from a CSV file.</li>
</ul>
<p><strong>Documentation</strong></p>
<p>The plugin includes a detailed help file in the admin panel. For a step-by-step tutorial, check out the <a href="https://wpsimplehacks.com/how-to-create-a-football-pool-site-with-wordpress/" rel="nofollow ugc">guide by Janek from WP Simple Hacks</a>. He even made a video explaining how to set up the plugin.</p>
<p><strong>Other Notes</strong></p>
<ul>
<li>Requires WordPress 5.3+, PHP 7.4+, and jQuery 1.4.3+.</li>
<li>For charts, download the <a href="http://www.highcharts.com/download" rel="nofollow ugc">Highcharts Charting Core package</a> (see the installation instructions or the help page in the admin).</li>
</ul>
<p>If you find bugs, please report them in the <a href="https://wordpress.org/support/plugin/football-pool" rel="ugc">support forum</a>. If you like the plugin, a rating on <a href="https://wordpress.org/extend/plugins/football-pool/" rel="ugc">WordPress.org</a> would be much appreciated!</p>
<h3>Localizations</h3>
<p>If you’d like to help translate the plugin into another language or keep existing translations up to date, head over to the plugin’s page on <a href="https://translate.wordpress.org/projects/wp-plugins/football-pool" rel="nofollow ugc">translate.wordpress.org</a>.</p>
<p>Be sure to read the <a href="https://make.wordpress.org/polyglots/handbook/translating/after-your-contribution/" rel="nofollow ugc">After your contribution</a> guide to understand how translations get reviewed and approved.</p>
<p>A big shout-out to all the <a href="https://translate.wordpress.org/projects/wp-plugins/football-pool/contributors/" rel="nofollow ugc">translation contributors and editors</a> who’ve helped out so far — thank you!</p>
<p>For using custom translations, check the FAQ section. The plugin also includes a <code>.pot</code> file as a starting point for building your own translation files.</p>
<h3>Shortcodes</h3>
<p>The plugin provides the following shortcodes. For detailed usage instructions, see the Help page in the WordPress admin.</p>
<ul>
<li><code>fp-predictions</code></li>
<li><code>fp-predictionform</code></li>
<li><code>fp-matches</code></li>
<li><code>fp-match-scores</code></li>
<li><code>fp-question-scores</code></li>
<li><code>fp-next-matches</code></li>
<li><code>fp-last-matches</code></li>
<li><code>fp-user-score</code></li>
<li><code>fp-user-ranking</code></li>
<li><code>fp-ranking</code></li>
<li><code>fp-countdown</code></li>
<li><code>fp-group</code></li>
<li><code>fp-link</code></li>
<li><code>fp-register</code></li>
<li><code>fp-totopoints</code></li>
<li><code>fp-fullpoints</code></li>
<li><code>fp-goalpoints</code></li>
<li><code>fp-diffpoints</code></li>
<li><code>fp-jokermultiplier</code></li>
<li><code>fp-plugin-option</code></li>
<li><code>fp-league-info</code></li>
<li><code>fp-chart-settings</code> / <code>fp-stats-settings</code></li>
<li><code>fp-user-list</code></li>
<li><code>fp-money-in-the-pot</code></li>
<li><code>fp-last-calc-date</code></li>
<li><code>fp-next-match-form</code></li>
</ul>
<h3>Incompatible Plugins & Themes</h3>
<p>The following plugins have been reported as incompatible with Football Pool. If you’re the author and have a fix — or if you know a workaround — please get in touch.</p>
<p>If you encounter issues with another plugin not listed here, let me know so I can investigate.</p>
<p><em>Most caching solutions should be tested carefully.</em></p>
<ul>
<li>DB Cache Reloaded Fix (v2.3)</li>
<li>Cimy User Extra Fields (v2.6.1) when using the email confirmation feature</li>
<li>Easy Timer (in Football Pool versions 2.3.8 and below)</li>
<li>Theme Gadgetry (ThemeFuse framework)</li>
<li>memcached</li>
</ul>
<p>Some themes may also interfere with the plugin’s display. See <a href="https://wordpress.org/support/topic/theme-compatibility-73/#post-17811227" rel="ugc">this forum post</a> for a potential fix.</p>