CVE-2026-85129
⚠️ highSummary
The Hoo Companion WordPress plugin 1.0.2 does not have any authorisation or validation checks in one of its import features, and does not sanitise the data submitted to it before storing it as the active theme's settings, allowing unauthenticated attackers to inject arbitrary web scripts which will execute for anyone viewing the site, including administrators. The same request destroys the site's existing theme settings.
CVSS Score
8.8
High
EPSS Score
0.3
Exploit Probability
Published Date
2026-09-13
First Seen: 2026-09-16
📊 Relative Risk Intelligence
This CVE is High Risk - more severe than 80.8% of all 357,695 vulnerabilities in our database.
#68,611
Top 25% most severe
Severity Percentile
🎯 CISA SSVC Assessment Updated: Sep 14, 2026
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
NO
Requires human interaction
💥 Technical Impact
Total
Complete system compromise possible
🏆 Discovered By
Enrico Marcolini (Dottor Marc)
Claudio Marchesini (Dottor Marc)
WPScan (coordinator)
SSVC data provided by
CISA
Last Modified
2026-09-14
Source
NVD 🔗
CVSS Vector 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE IDs (Weakness Types)