CVE-2026-86798

Summary

The HootBoard WordPress plugin has unauthenticated REST endpoints that allow arbitrary script injection without proper authorization checks or output escaping, enabling attackers to execute malicious scripts in visitors' browsers including administrators.

Exploitability

Exploitation is relatively straightforward requiring only a single HTTP request to the vulnerable REST endpoint with a crafted payload, with no authentication required and minimal preconditions.

Blast radius

The impact could be severe as the injected scripts would execute in the browser context of any visitor, including administrators, potentially leading to full account takeovers or persistent backdoors.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to HootBoard plugin version 3.1.5 or later which contains the fix for the authorization and output escaping issues.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.