CVE-2026-85129

Name of the Vulnerable Software and Affected Versions Hoo Companion WordPress plugin version 1.0.2

Description An import feature lacks authorization and validation checks and fails to sanitize submitted data before storing it as the active theme settings. This allows unauthenticated attackers to perform a Stored Cross-Site Scripting (XSS) attack—where malicious scripts are permanently stored on the server—which will execute for any user viewing the site, including administrators. Additionally, the same request overwrites and destroys existing theme settings.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.