blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-85129

HIGH 8.8 CVSS 3.1
Published
September 13, 2026
Last modified
September 14, 2026
NVD status
Deferred
Reported by
contact@wpscan.com
Weakness
CWE-79
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Description

The Hoo Companion WordPress plugin 1.0.2 does not have any authorisation or validation checks in one of its import features, and does not sanitise the data submitted to it before storing it as the active theme's settings, allowing unauthenticated attackers to inject arbitrary web scripts which will execute for anyone viewing the site, including administrators. The same request destroys the site's existing theme settings.

Affected products and versions

  • Unknown Hoo Companion — From 1.0.2 (including) to 1.0.2 (including)

References

  • wpscan.com https://wpscan.com/vulnerability/a50f6ec1-4297-453e-b45f-6fd889b6b0d2/
  • nvd.nist.gov Official NVD record