Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-85129

Hoo Companion 1.0.2 - Unauthenticated Stored XSS via Theme Settings Import

CVSS 3.1 8.8 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-85129

Published

The Hoo Companion WordPress plugin 1.0.2 does not have any authorisation or validation checks in one of its import features, and does not sanitise the data submitted to it before storing it as the active theme's settings, allowing unauthenticated attackers to inject arbitrary web scripts which will execute for anyone viewing the site, including administrators. The same request destroys the site's existing theme settings.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-85129

Published

Hoo Companion

https://wordpress.org/plugins

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Unknown",
                    "product": "Hoo Companion",
                    "versions": [
                        {
                            "status": "affected",
                            "versionType": "semver",
                            "version": "1.0.2",
                            "lessThanOrEqual": "1.0.2"
                        }
                    ],
                    "defaultStatus": "unknown",
                    "collectionURL": "https://wordpress.org/plugins"
                }

Original source record · Cite this exact observation · Complete original publisher JSON