---
id: CVE-2026-85129
title: >-
  The Hoo Companion WordPress plugin 1.0.2 does not have any authorisation or
  validation checks in one of its import features, and does not sanitise the
  data submitted to it before storing it as the active theme's settings,
  allowing unauth…
summary: >-
  The Hoo Companion WordPress plugin 1.0.2 does not have any authorisation or
  validation checks in one of its import features, and does not sanitise the
  data submitted to it before storing it as the active theme's settings,
  allowing unauth…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cwe:
  - CWE-79
product: Hoo Companion
affected:
  - hoo_companion >= 1.0.2 <= 1.0.2
published: '2026-09-13'
updated: '2026-09-14'
sourceUpdated: '2026-09-14T21:10:17.423'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-85129'
references:
  - url: 'https://wpscan.com/vulnerability/a50f6ec1-4297-453e-b45f-6fd889b6b0d2/'
    label: contact@wpscan.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-14T12:37:29.885131Z'
ingestedAt: '2026-09-14T15:23:07.431Z'
epss: 0.00263
epssPercentile: 0.18428
---

## Overview

The Hoo Companion WordPress plugin 1.0.2 does not have any authorisation or validation checks in one of its import features, and does not sanitise the data submitted to it before storing it as the active theme's settings, allowing unauthenticated attackers to inject arbitrary web scripts which will execute for anyone viewing the site, including administrators. The same request destroys the site's existing theme settings.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.