CVE-2026-85129

Deferred Deferred - Pending Action

Stored Cross-Site Scripting in Hoo Companion WordPress Plugin

Publication date: 2026-09-13

Last updated on: 2026-09-14

Assigner: WPScan

Description

The Hoo Companion WordPress plugin 1.0.2 does not have any authorisation or validation checks in one of its import features, and does not sanitise the data submitted to it before storing it as the active theme's settings, allowing unauthenticated attackers to inject arbitrary web scripts which will execute for anyone viewing the site, including administrators. The same request destroys the site's existing theme settings.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-13

Last Modified

2026-09-14

Generated

2026-10-04

AI Q&A

2026-09-14

EPSS Evaluated

2026-10-02

NVD

CVE-2026-85129

Affected Vendors & Products

Vendor	Product	Version / Range
hoocompanion	hoocompanion	1.0.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Hoo Companion WordPress plugin version 1.0.2. It lacks authorization and validation checks in an import feature. Attackers can exploit this to inject malicious scripts without authentication. These scripts execute when the site is viewed, including by administrators. The attack also overwrites the site's existing theme settings.

Detection Guidance

Check for unauthenticated POST requests to the Hoo Companion plugin's import feature. Look for unusual theme settings changes or JavaScript injections in the active theme. Inspect server logs for requests to /wp-admin/admin-post.php with suspicious parameters.

Impact Analysis

Unauthenticated attackers can inject harmful scripts into your website. These scripts run for all visitors, including admins, potentially stealing data or taking control. Your site's theme settings may also be destroyed, breaking its appearance and functionality.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR and HIPAA requirements for protecting user data. Unauthorized script execution may expose sensitive information, resulting in legal penalties and loss of compliance certifications.

Mitigation Strategies

Disable the Hoo Companion WordPress plugin immediately. Update to the latest version if available. Review theme settings for unauthorized changes. Implement strict input validation and authorization checks for all plugin features.

Hi! I’m here to help you understand CVE-2026-85129. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70