HootBoard WordPress Plugin CVE-2026-86798

Exploitation requires that the site run the HootBoard WordPress plugin version ≤3.1.4 with its vulnerable REST endpoints reachable (the default state, since the flaw is the absence of any authorization check). No authentication and no attacker privileges are needed to inject (PR:N). The primary limiting factor is that the payload is stored XSS: it only executes when a user - ideally a logged-in administrator - subsequently visits the public page where the unescaped value is output (UI:R, victim interaction required). Full impact therefore depends on an administrator or privileged user viewing the poisoned page; against anonymous visitors the impact is limited to client-side script execution in their own browser.

This is a credible, actionable priority despite the absence of EPSS and KEV data. The CVSS vector (AV:N/AC:L/PR:N/UI:R) describes a network-reachable, low-complexity, unauthenticated flaw, and the WPScan-published description confirms the root cause: missing authorization on REST endpoints combined with missing output escaping, yielding stored (persistent) XSS. A public exploit exists (WPScan), which raises practical risk above a theoretical high-CVSS issue. However, several signals are missing or should be qualified: no EPSS probability is provided, so widespread automated exploitation cannot be quantified; the vulnerability is NOT in CISA KEV, so there is no evidence of active in-the-wild exploitation - public POC availability and active exploitation are distinct signals and should not be conflated. The input CVSS impact of C:H/I:H/A:H (score 8.8) appears aggressive for a stored XSS: typical stored-XSS impact is partial (Low) with a scope change, and the high score here likely reflects that script executing in an administrator's authenticated session can be escalated to full site compromise. Net: a real, exploitable flaw worth prompt patching for any site running HootBoard, but its real-world blast radius is bounded by the plugin's limited deployment footprint and the requirement that a victim (ideally an admin) view the poisoned page.

An unauthenticated attacker sends a request to one of HootBoard's unprotected REST endpoints, storing a malicious JavaScript payload that is later rendered unescaped on a public page. When a logged-in administrator (or any visitor) views that page, the script executes in their browser session, enabling session/cookie theft or admin-context actions such as creating a rogue admin or installing a backdoor. A public exploit is available via WPScan, lowering the barrier to reproduction.