Known vulnerabilities in Football Pool

Add some game-day fun to your WordPress site! Let users predict match results, earn points, and go head-to-head in a fantasy sports pool.

9Reported vulnerabilities

6.4Highest CVSS score

2.13.5Latest version

1,000+Active installs

What to do now

Update Football Pool to 2.13.5 or later. 9 of these have a fixed version available. Updating resolves them.

Plugin last updated: May 20, 2026 / Tested up to WordPress: 6.9.7 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
CVE-2024-43139	Medium 6.4	0.3%	2.11.9 and earlier	`2.11.10`	August 7, 2024
CVE-2024-29802	Medium 6.4	0.4%	2.11.3 and earlier	`2.11.4`	January 8, 2024
CVE-2025-58987	Medium 6.4	0.2%	2.12.6 and earlier	`2.13.0`	September 9, 2025
CVE-2025-53280	Medium 6.4	0.2%	2.12.5 and earlier	`2.12.6`	June 27, 2025
CVE-2017-18524	Medium 6.1	0.9%	Before 2.6.5	`2.6.5`	August 20, 2019
CVE-2026-8790	Medium 6.1	0.2%	0 to 2.13.4 (inclusive)	`2.13.5`	August 5, 2026
CVE-2025-5490	Medium 4.8	0.2%	Before 2.12.5	`2.12.5`	June 19, 2025
CVE-2024-43130	Medium 4.4	0.3%	2.11.10 and earlier	`2.12.1`	August 7, 2024
CVE-2025-30764	Medium 4.3	0.2%	2.12.2 and earlier	`2.12.3`	March 26, 2025

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.