CVE-2026-86798: HootBoard <= 3.1.4 - Unauthenticated Stored XSS via Board Configuration REST Endpoint

Q: Who can exploit this issue and who is at risk from the injected code?

An unauthenticated attacker can use affected REST endpoints to store malicious script content. The script executes in the browsers of visitors to the affected public page, including WordPress administrators.

Q: Does exploiting this require a WordPress account or elevated permissions?

No. The affected REST endpoints lack an authorization check, so an attacker does not need to authenticate or hold a WordPress role to inject the stored content.

Q: Which versions are affected?

HootBoard versions through 3.1.4 are affected.

Published Oct 11, 2026

Updated

The HootBoard WordPress plugin through 3.1.4 does not perform any authorisation check on some of its REST endpoints, and does not escape the values stored through them before outputting them in a public page, allowing unauthenticated users to inject arbitrary web scripts that will execute in the browser of anyone visiting that page, including administrators.

Affected Software

1 affected component

HootBoard HootBoard<=3.1.4

Event History

Oct 11, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·07:17 AM

Description

Frequently Asked Questions

Who can exploit this issue and who is at risk from the injected code?

An unauthenticated attacker can use affected REST endpoints to store malicious script content. The script executes in the browsers of visitors to the affected public page, including WordPress administrators.

Does exploiting this require a WordPress account or elevated permissions?

No. The affected REST endpoints lack an authorization check, so an attacker does not need to authenticate or hold a WordPress role to inject the stored content.

Which versions are affected?

HootBoard versions through 3.1.4 are affected.

CVE-2026-86798: HootBoard <= 3.1.4 - Unauthenticated Stored XSS via Board Configuration REST Endpoint

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue and who is at risk from the injected code?

Does exploiting this require a WordPress account or elevated permissions?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue and who is at risk from the injected code?

Does exploiting this require a WordPress account or elevated permissions?

Which versions are affected?