CVE-2026-85129: Hoo Companion WordPress Plugin XSS Vulnerability

CVE-2026-85129 Overview

CVE-2026-85129 affects the Hoo Companion WordPress plugin version 1.0.2. The plugin exposes an import feature that lacks authorization checks and input sanitization. Unauthenticated attackers can submit crafted data that overwrites the active theme's settings and injects arbitrary web scripts. These scripts execute in the browser of any visitor, including administrators. The same request also destroys the site's existing theme settings, causing an availability impact alongside the stored cross-site scripting (XSS) payload. The vulnerability is tracked as CWE-79 — Improper Neutralization of Input During Web Page Generation.

Critical Impact
Unauthenticated attackers can inject persistent JavaScript that runs in administrator sessions while simultaneously destroying theme configuration data.

Affected Products

Hoo Companion WordPress plugin version 1.0.2
WordPress sites running Hoo Companion with the vulnerable import endpoint exposed
Any active theme whose settings are managed by the plugin

Discovery Timeline

2026-09-13 - CVE-2026-85129 published to the National Vulnerability Database
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-85129

Vulnerability Analysis

The Hoo Companion plugin exposes an import handler intended to load theme settings. The handler processes incoming requests without verifying the caller's identity or capability. Any anonymous HTTP client can invoke it. Once triggered, the handler writes attacker-controlled data into the active theme's settings store without escaping or sanitizing values. WordPress subsequently renders those stored values into pages served to site visitors, causing injected <script> payloads to execute in the browser context of anyone who loads the site. Because administrators view the same rendered content, an attacker can obtain session-scoped code execution in the WordPress admin, enabling account takeover or plugin/theme installation. As a secondary effect, the import operation replaces the prior theme settings, resulting in loss of legitimate site configuration.

Root Cause

Two defects combine to produce the vulnerability. First, the import feature performs no capability check (missing current_user_can() verification) and no nonce validation, so unauthenticated requests reach the handler. Second, submitted values are stored directly as theme settings without sanitization functions such as sanitize_text_field(), wp_kses(), or esc_html(). The stored values are later echoed into rendered HTML, satisfying the conditions for stored XSS ([CWE-79]).

Attack Vector

Exploitation requires only network access to the target WordPress site. An attacker sends a single HTTP request to the plugin's import endpoint carrying a JavaScript payload embedded in a settings field. WordPress persists the payload as active theme configuration. When an administrator or visitor next loads a page that renders that field, the injected script runs in their browser. Because the request path does not require prior authentication, mass exploitation across WordPress sites hosting the plugin is straightforward. The user interaction requirement is satisfied by any subsequent page view.

No verified public exploit code is available. Additional technical detail is documented in the WPScan Vulnerability Report.

Detection Methods for CVE-2026-85129

Indicators of Compromise

Unexpected <script>, onerror, or onload attributes appearing in theme option values stored in wp_options
Sudden reset or blanking of theme customization settings without an administrator action in the audit log
POST requests from unauthenticated sources to the Hoo Companion import endpoint in web server access logs
Outbound requests from administrator browsers to unfamiliar domains shortly after visiting the WordPress admin

Detection Strategies

Query the wp_options table for theme mods containing HTML tags, event handlers, or javascript: URIs
Alert on HTTP requests to plugin admin-ajax or REST routes originating without valid authentication cookies
Compare current theme settings against a known-good backup to detect unauthorized overwrite
Deploy a web application firewall (WAF) rule that inspects request bodies to the plugin's import handler for script tokens

Monitoring Recommendations

Enable WordPress activity logging to record option changes with source IP and user context
Forward web server and WordPress logs to a centralized platform for correlation and retention
Monitor for creation of new administrator accounts or unexpected plugin installations following suspicious import requests

How to Mitigate CVE-2026-85129

Immediate Actions Required

Deactivate the Hoo Companion plugin until a fixed version is confirmed by the vendor
Restore theme settings from a known-good backup if unauthorized overwrite is detected
Rotate administrator credentials and invalidate active sessions if XSS execution against an admin is suspected
Audit wp_options for injected script content and remove any attacker-controlled values

Patch Information

At the time of publication, no fixed version of the Hoo Companion plugin is referenced in the NVD entry. Site operators should monitor the WPScan Vulnerability Report and the plugin's WordPress.org listing for an updated release that adds capability checks, nonce verification, and output sanitization.

Workarounds

Block requests to the plugin's import endpoint at the WAF or reverse proxy layer
Restrict access to wp-admin/admin-ajax.php and REST routes used by the plugin to authenticated sessions only
Remove the plugin entirely if it is not business-critical
Apply a Content Security Policy (CSP) that disallows inline scripts to reduce the impact of stored XSS

bash

# Example nginx rule to block unauthenticated POSTs to the plugin endpoint
location ~* /wp-content/plugins/hoo-companion/ {
    limit_except GET { deny all; }
}