The football-pool plugin prior to 2.6.5 for WordPress has multiple XSS issues.
football pool project football pool