CVE-2025-5490 in Football Pool Plugin
Summary
by MITRE • 06/19/2025
The Football Pool plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.12.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 06/24/2025
The vulnerability identified as CVE-2025-5490 affects the Football Pool plugin for WordPress, representing a critical stored cross-site scripting flaw that compromises the security of affected installations. This vulnerability exists within the plugin's admin settings functionality and impacts all versions up to and including 2.12.4, making it a persistent threat across multiple release cycles. The flaw stems from inadequate input sanitization and insufficient output escaping mechanisms that fail to properly validate and sanitize user-supplied data before processing and storage within the WordPress environment.
The technical implementation of this vulnerability allows authenticated attackers with administrator-level permissions or higher to inject malicious scripts directly into the plugin's administrative settings. When these malicious inputs are saved and subsequently rendered in administrative pages, they execute in the context of other users who access those pages, creating a persistent threat vector. The attack requires the attacker to have administrative privileges, but once achieved, the impact extends beyond the immediate attacker to all users who might access the compromised administrative interfaces. This vulnerability specifically targets multi-site WordPress installations where the unfiltered_html capability has been disabled, indicating that the security model relies on specific permission configurations to maintain protection boundaries.
The operational impact of CVE-2025-5490 extends beyond simple script execution, as it enables attackers to potentially escalate privileges, steal session cookies, perform unauthorized administrative actions, or redirect users to malicious websites. The stored nature of the vulnerability means that malicious scripts persist in the database and execute automatically whenever affected pages are accessed, making detection more challenging and the attack surface more extensive. This vulnerability aligns with CWE-79, which specifically addresses cross-site scripting flaws, and represents a direct violation of the principle of least privilege and proper input validation. The attack vector leverages the trust relationship between the WordPress admin interface and its users, potentially allowing for privilege escalation attacks that could compromise entire WordPress installations.
Organizations affected by this vulnerability should immediately implement mitigations including plugin updates to the latest secure versions, which would address the input sanitization and output escaping deficiencies. Administrative users should be restricted to the minimum necessary permissions, and enhanced monitoring of administrative settings changes should be implemented. The WordPress security team recommends disabling the Football Pool plugin until a patched version is deployed, particularly in multi-site installations where the attack surface is amplified. Network segmentation and web application firewalls can provide additional defense-in-depth measures, while regular security audits of plugin configurations should be conducted to identify similar vulnerabilities. This vulnerability demonstrates the importance of proper input validation and output escaping as fundamental security controls, aligning with ATT&CK technique T1548.001 for privilege escalation through administrative access and T1566 for initial access via web application vulnerabilities.