XSS in Hoo Companion
CVE-2026-85129
The Hoo Companion WordPress plugin 1.0.2 does not have any authorisation or validation checks in one of its import features, and does not sanitise the data submitted to it before storing it as the active theme's settings, allowing unauthenticated attackers to inject arbitrary web scripts which will execute for anyone viewing the site, including administrators. The same request destroys the site's existing theme settings.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.003 (18.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Unknown Hoo Companion
Weakness classification (CWE)
References
- contact@wpscan.com (technical-description, exploit, vdb-entry)
Frequently asked questions
- What is CVE-2026-85129?
- CVE-2026-85129 is a high-severity vulnerability in Hoo Companion, classified under Cross-site Scripting. CVSS score: 8.8/10. Published 2026-09-13.
- How severe is CVE-2026-85129?
- High severity. CVSS v3 base score is 8.8 out of 10.