Hoo Companion
Monthly
Unauthenticated stored XSS and theme settings destruction in the Hoo Companion WordPress plugin (≤1.0.2) allows any remote attacker to inject persistent JavaScript into the active theme's settings via the plugin's ungated import endpoint, causing malicious scripts to execute in every visitor's browser including administrators. The same single request unconditionally overwrites and destroys the site's existing theme settings, combining a persistent cross-site scripting attack with immediate site defacement. A publicly available exploit exists via WPScan; no public exploit identified at time of analysis for active exploitation (not in CISA KEV).
Unauthenticated stored XSS and theme settings destruction in the Hoo Companion WordPress plugin (≤1.0.2) allows any remote attacker to inject persistent JavaScript into the active theme's settings via the plugin's ungated import endpoint, causing malicious scripts to execute in every visitor's browser including administrators. The same single request unconditionally overwrites and destroys the site's existing theme settings, combining a persistent cross-site scripting attack with immediate site defacement. A publicly available exploit exists via WPScan; no public exploit identified at time of analysis for active exploitation (not in CISA KEV).