Hootboard
Monthly
Unauthenticated stored cross-site scripting in the HootBoard WordPress plugin (all versions through 3.1.4) lets any remote attacker inject arbitrary JavaScript through the plugin's REST endpoints, which lack authorization checks and store values without escaping before rendering them on a public page. The injected script executes in the browser of any visitor to that page - most dangerously a logged-in administrator, which is the path to full site compromise - but it requires the victim to view the poisoned page, so the impact is client-side and conditional rather than direct server takeover. Publicly available exploit code exists (the WPScan disclosure entry doubles as an exploit reference) and no vendor patch has been confirmed; our independent vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) rates this below the 8.8 vendor score, reflecting the interaction requirement and the typically low-severity confidentiality/integrity effect on the victim's browser session alone. No EPSS or CISA KEV data is present in the feed, so this should be treated as an actionable priority rather than a confirmed active exploitation event.
Unauthenticated stored cross-site scripting in the HootBoard WordPress plugin (all versions through 3.1.4) lets any remote attacker inject arbitrary JavaScript through the plugin's REST endpoints, which lack authorization checks and store values without escaping before rendering them on a public page. The injected script executes in the browser of any visitor to that page - most dangerously a logged-in administrator, which is the path to full site compromise - but it requires the victim to view the poisoned page, so the impact is client-side and conditional rather than direct server takeover. Publicly available exploit code exists (the WPScan disclosure entry doubles as an exploit reference) and no vendor patch has been confirmed; our independent vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) rates this below the 8.8 vendor score, reflecting the interaction requirement and the typically low-severity confidentiality/integrity effect on the victim's browser session alone. No EPSS or CISA KEV data is present in the feed, so this should be treated as an actionable priority rather than a confirmed active exploitation event.