EUVD-2026-77086
GHSA-cc6h-6xh4-hfv7
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
S:C applied because stored XSS executing in administrator browsers enables cross-context privilege escalation beyond the vulnerable plugin component; all other metrics align with the supplied vector.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The Hoo Companion WordPress plugin 1.0.2 does not have any authorisation or validation checks in one of its import features, and does not sanitise the data submitted to it before storing it as the active theme's settings, allowing unauthenticated attackers to inject arbitrary web scripts which will execute for anyone viewing the site, including administrators. The same request destroys the site's existing theme settings.
AnalysisAI
Unauthenticated stored XSS and theme settings destruction in the Hoo Companion WordPress plugin (≤1.0.2) allows any remote attacker to inject persistent JavaScript into the active theme's settings via the plugin's ungated import endpoint, causing malicious scripts to execute in every visitor's browser including administrators. The same single request unconditionally overwrites and destroys the site's existing theme settings, combining a persistent cross-site scripting attack with immediate site defacement. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication or WordPress account is required - the import endpoint performs no capability check and accepts unauthenticated POST requests from any network-accessible attacker. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (8.8 High) correctly captures the unauthenticated, low-complexity network attack with no privilege requirement. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patched version is identified at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Immediately disable and remove the Hoo Companion plugin from all affected WordPress installations; audit web server and application logs for requests to the plugin's import endpoint and inspect WordPress database for unexpected changes to theme settings or injected JavaScript. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today