WordPress plugin
Football Pool security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 10 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High0
- Medium10
- Low0
All Football Pool vulnerabilities
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Shoutbox Message
≤2.13.5Update to 2.13.6
- Medium6.1Authenticated (Subscriber+) Reflected Cross-Site Scripting
≤2.13.4Update to 2.13.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.12.6Update to 2.13.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.12.5Update to 2.12.6
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
≤2.12.4Update to 2.12.5
- Medium4.3Cross-Site Request Forgery to Settings Update
≤2.12.2Update to 2.12.3
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
≤2.11.9Update to 2.11.10
- Medium4.4Authenticated (Editor+) Stored Cross-Site Scripting
≤2.11.10Update to 2.12.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.11.3Update to 2.11.4
- Medium6.1Cross-Site Scripting
<2.6.5Update to 2.6.5
Football Pool: common questions
Does Football Pool have known vulnerabilities?
Yes. VulnCrest Radar lists 10 known vulnerabilities in Football Pool: 10 medium. None are known to affect version null.
How do I check which version of Football Pool I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Football Pool vulnerability?
CVE-2026-118050, published Nov 6, 2026: Football Pool <= 2.13.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Shoutbox Message. Severity: Medium (CVSS 6.4).
Is any Football Pool vulnerability listed in CISA KEV?
No. None of the known Football Pool vulnerabilities is currently listed in the CISA KEV catalog.