CVE-2026-86798: high-severity vulnerability in HootBoard
HootBoard <= 3.1.4 - Unauthenticated Stored XSS via Board Configuration REST Endpoint
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
41Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 8.8epss 0.3%
The HootBoard WordPress plugin through 3.1.4 does not perform any authorisation check on some of its REST endpoints, and does not escape the values stored through them before outputting them in a public page, allowing unauthenticated users to inject arbitrary web scripts that will execute in the browser of anyone visiting that page, including administrators.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Unknown · HootBoardpublic PoCs found — 1
cve_referencewpscan.com/vulnerability/a0cfbbb7-4cc5-4ec0-b420-e249204fcd46/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.