Executive brief
The Hoo Companion WordPress plugin allows unauthenticated attackers to inject malicious code into a website's theme settings without any authorization checks or data validation. When exploited, the injected code executes for all visitors, including administrators, and simultaneously destroys the site's existing theme configuration, rendering the site unusable.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in the Hoo Companion plugin's theme settings import feature. The vulnerability exists because the plugin lacks authorization checks (allowing unauthenticated access) and does not sanitize or validate user input before storing it as theme settings. An attacker can submit malicious web scripts via the import function, which are then persistently stored and executed in the browser of every site visitor. The same request also overwrites and destroys the legitimate theme settings. No patch is currently available for version 1.0.2.
Affected products
- Hoo Companion 1.0.2
Timeline
- 2026-09-10: disclosed
- 2026-09-13: advisory