CVE-2026-15604
Received Received - Intake

Stored XSS in Toocheke Companion WordPress Plugin

Publication date: 2026-08-16

Last updated on: 2026-08-16

Assigner: Wordfence

Description
The Toocheke Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.10 via the 'series_bg_color' post meta field. This is due to insufficient input sanitization in the toocheke_series_bg_color_save() function (which stores the raw $_POST value in post meta) and insufficient output escaping in the series admin column rendering (where the stored value is concatenated into a style attribute without esc_attr()). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user, such as an administrator, accesses the series list table in the admin dashboard.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-16
Last Modified
2026-08-16
Generated
2026-08-16
AI Q&A
2026-08-16
EPSS Evaluated
N/A
NVD
CVE-2026-15604
EUVD
EUVD-2026-59893

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
toocheke companion to 2.10 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Toocheke Companion plugin for WordPress has a stored Cross-Site Scripting (XSS) vulnerability in versions up to 2.10. It occurs because user input in the 'series_bg_color' field is not properly sanitized before being saved to post meta. Additionally, when the value is displayed in the admin dashboard, it is not properly escaped, allowing the stored script to execute when an administrator views the series list.

Detection Guidance

Check WordPress admin dashboard for the Toocheke Companion plugin versions up to 2.10. Inspect post meta fields for 'series_bg_color' containing suspicious scripts. Review series list table in admin for unexpected style attributes.

Impact Analysis

An authenticated attacker with contributor-level access or higher could inject malicious scripts into WordPress pages. These scripts would execute when an administrator views the series list in the admin dashboard, potentially leading to unauthorized actions, data theft, or further compromise of the WordPress site.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate GDPR (data protection) or HIPAA (health information privacy) requirements. Organizations must ensure their WordPress plugins are updated to mitigate risks of data exposure or compliance violations.

Mitigation Strategies

Update the Toocheke Companion plugin to the latest version. Remove or sanitize any injected scripts in the 'series_bg_color' post meta field. Restrict contributor-level access to prevent further exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15604. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart