{"id":"CVE-2026-86798","published":"2026-10-11T07:17:26.450","lastModified":"2026-10-13T20:36:00.850","description":"The HootBoard  WordPress plugin through 3.1.4 does not perform any authorisation check on some of its REST endpoints, and does not escape the values stored through them before outputting them in a public page, allowing unauthenticated users to inject arbitrary web scripts that will execute in the browser of anyone visiting that page, including administrators.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-79"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/a0cfbbb7-4cc5-4ec0-b420-e249204fcd46/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The HootBoard WordPress plugin has unauthenticated REST endpoints that allow arbitrary script injection without proper authorization checks or output escaping, enabling attackers to execute malicious scripts in visitors' browsers including administrators.","exploitability":"Exploitation is relatively straightforward requiring only a single HTTP request to the vulnerable REST endpoint with a crafted payload, with no authentication required and minimal preconditions.","blast_radius":"The impact could be severe as the injected scripts would execute in the browser context of any visitor, including administrators, potentially leading to full account takeovers or persistent backdoors.","remediation":"Upgrade to HootBoard plugin version 3.1.5 or later which contains the fix for the authorization and output escaping issues.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["xss","rest-api","wordpress","plugin"],"model":"garnet-coder","analyzedAt":"2026-10-13T08:54:20.612Z"}}