Vulnerabilities and security researches forhoo-companion hoo-companion

Sep 16, 2026

CVE, Research URL: CVE-2026-85129
Home page URL: Security reports for Hoo Companion
Application: Hoo Companion
Date: Sep 14, 2026
Research Description: The Hoo Companion WordPress plugin 1.0.2 does not have any authorisation or validation checks in one of its import features, and does not sanitise the data submitted to it before storing it as the active theme's settings, allowing unauthenticated attackers to inject arbitrary web scripts which will execute for anyone viewing the site, including administrators. The same request destroys the site's existing theme settings.
Affected versions: max 1.0.2.
Status: vulnerable