CVE-2026-15604

Name of the Vulnerable Software and Affected Versions Toocheke Companion versions prior to 2.11

Description The Toocheke Companion plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs because the toocheke series bg color save() function fails to properly sanitize input from the series bg color post meta field, storing raw $ POST values. Additionally, the series admin column rendering does not use esc attr() when concatenating the stored value into a style attribute. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts that execute when a user, such as an administrator, views the series list table in the admin dashboard.

Recommendations Update to a version newer than 2.10. As a temporary mitigation, restrict access to the series bg color post meta field for users with contributor-level permissions.