Description

The Hoo Companion WordPress plugin 1.0.2 does not have any authorisation or validation checks in one of its import features, and does not sanitise the data submitted to it before storing it as the active theme's settings, allowing unauthenticated attackers to inject arbitrary web scripts which will execute for anyone viewing the site, including administrators. The same request destroys the site's existing theme settings.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-13T21:17:02.063Z",
  "pubdate": "2026-09-13T21:17:02.063Z",
  "executiveSummary": "The Hoo Companion WordPress plugin version 1.0.2 is susceptible to an unauthenticated Stored Cross-Site Scripting (XSS) vulnerability. The flaw originates from the absence of authorization checks and input validation within a specific theme settings import feature.\nAn unauthenticated attacker can exploit this vulnerability by submitting a crafted request to the plugin, which forces the injection of arbitrary malicious JavaScript into the active theme's settings. Because the input is stored without sanitization, the injected payload is subsequently rendered in the browser of any user viewing the affected site, including administrative sessions.\nThis vulnerability carries high risk implications, as successful exploitation allows for unauthorized script execution, potential session hijacking, administrative account takeover, and the destruction of existing site theme configurations.\nThe exploit requires no prior authentication or administrative privileges, making it accessible to remote attackers with network access to the target WordPress installation.",
  "technicalDetails": "The vulnerability resides in the theme settings import mechanism of the Hoo Companion 1.0.2 plugin. The core issue is twofold: a complete lack of authorization controls on the import endpoint and a failure to implement input sanitization before persisting user-supplied data to the WordPress options table.\nWhen a request is made to the vulnerable import feature, the plugin fails to verify the requestor's identity or capabilities. Consequently, an unauthenticated remote attacker can trigger the import process by sending a specially crafted HTTP request to the target site. The plugin does not validate the structure or content of the imported payload, allowing for the injection of arbitrary HTML and JavaScript tags into the theme settings data.\nOnce the malicious payload is processed, the plugin overwrites the site's existing theme configuration with the attacker-supplied data. This results in the immediate destruction of the current theme's operational settings, causing a denial-of-service condition regarding site aesthetics and functionality.\nThe attack flow proceeds as follows: 1) The attacker identifies the target endpoint responsible for theme settings imports. 2) The attacker crafts a request containing an XSS payload (e.g., <script>alert(document.cookie)</script>) within the configuration parameters. 3) The attacker submits the request without authentication. 4) The plugin accepts the input without verifying the origin or the character set, saving the malicious string directly into the database. 5) Whenever a user or administrator loads a page utilizing these theme settings, the injected script is rendered by the victim's browser within the context of the site origin.\nBecause the payload is stored persistently in the database, the XSS is 'stored' or 'persistent,' ensuring that the script executes for every visitor until the malicious theme settings are manually removed or corrected in the database. The impact is significant, as it permits the theft of session tokens, execution of unauthorized administrative actions via the victim's browser, and site defacement through DOM manipulation."
}