Toocheke Companion Vulnerabilities

The Toocheke Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.10 via the 'series_bg_color' post meta field. This is due to insufficient input sanitization in the toocheke_series_bg_color_save() function (which stores the raw $_POST value in post meta) and i...

CVSS:

6.4

Affected:

up to 2.10

Fixed in:

2.11

Disclosed:

Aug 15, 2026

CVE-2026-15604 on NVD →

The Toocheke Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.194 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pag...

CVSS:

6.4

Affected:

up to 1.194

Fixed in:

1.195

Disclosed:

Feb 21, 2026

CVE-2026-32403 on NVD →

The Toocheke Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.166 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to injec...

CVSS:

4.4

Affected:

up to 1.166

Fixed in:

1.167

Disclosed:

Jan 22, 2025

CVE-2025-23992 on NVD →