The vulnerability in the HootBoard WordPress plugin allows an attacker to submit data through unsecured REST endpoints that are not protected by an authorization check. The data stored by these endpoints is subsequently rendered on a public page without any escaping, enabling arbitrary JavaScript to be injected. Because the script runs in the context of any visitor, an attacker could hijack sessions, steal credentials, deface pages, or perform further malicious actions as the site administrator.

All WordPress sites that have the HootBoard plugin installed with a version through 3.1.4 are affected. The issue is present in the plugin’s configuration REST endpoint, and no vendor version beyond 3 has been specified as vulnerable in the current disclosure.

The vulnerability is a significant risk due to its lack of authentication and its potential to compromise any user who views the affected page, including administrators. The EPSS score is < 1%, indicating a low but nonzero probability of exploitation, and the flaw is not listed in CISA’s KEV catalog. The CVSS score is 8.8, classifying the vulnerability as high severity and highlighting the need for urgent remediation.