Description

The Toocheke Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.10 via the 'series_bg_color' post meta field. This is due to insufficient input sanitization in the toocheke_series_bg_color_save() function (which stores the raw $_POST value in post meta) and insufficient output escaping in the series admin column rendering (where the stored value is concatenated into a style attribute without esc_attr()). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user, such as an administrator, accesses the series list table in the admin dashboard.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-08-16T06:16:50.840Z",
  "pubdate": "2026-08-16T06:16:50.840Z",
  "executiveSummary": "The Toocheke Companion plugin for WordPress in versions up to, and including, 2.10 suffers from a Stored Cross-Site Scripting (XSS) vulnerability. This security flaw enables authenticated attackers with contributor-level access and above to inject arbitrary web scripts into administrative pages. The vulnerability stems from improper handling of the 'series_bg_color' post meta field, which lacks adequate input sanitization during storage and fails to utilize proper output escaping when rendered in the administrative interface.\nThe impact of this vulnerability is significant, as malicious scripts injected via the post meta field execute within the browser context of any user who accesses the series list table within the WordPress admin dashboard, including high-privileged users such as administrators. This elevates the risk profile, potentially allowing attackers to perform unauthorized administrative actions, steal sensitive session data, or manipulate the site content. Exploitation requires authentication with at least contributor privileges, meaning an attacker must first obtain valid user credentials to interact with the application logic.\nOrganizations utilizing the affected plugin version face potential integrity and confidentiality risks within their WordPress administration panels. Mitigation requires updating the plugin once a patched version is made available by the vendor, implementing strict input sanitization practices, and ensuring proper output context escaping across all custom meta fields and administrative tables.",
  "technicalDetails": "The vulnerability resides within the Toocheke Companion plugin for WordPress, specifically affecting versions up to, and including, 2.10. The core architectural deficiency involves two distinct security failures: a lack of input sanitization and an absence of proper output escaping. The vulnerable component is centered around the toocheke_series_bg_color_save() function, which is responsible for processing and storing post meta data.\nDuring the data ingestion phase, the toocheke_series_bg_color_save() function retrieves the raw $_POST value associated with the 'series_bg_color' post meta field and persists it directly into the database without performing adequate input sanitization or validation. Consequently, malicious payloads—such as JavaScript code or HTML markup designed to break out of attribute contexts—are stored persistently as post meta associated with the targeted post.\nThe second vector of the vulnerability occurs during the rendering phase when the series admin column is generated. The stored raw value of 'series_bg_color' is directly concatenated into a style attribute without the application of context-aware output escaping functions such as esc_attr(). When an authenticated user with administrator privileges or other authorized roles accesses the series list table in the WordPress admin dashboard, the unescaped payload is rendered directly into the Document Object Model (DOM).\nThe attack flow proceeds as follows: First, an attacker authenticates to the WordPress platform with contributor-level access or higher. Second, the attacker crafts a malicious request containing a payload targeting the 'series_bg_color' parameter when creating or updating a post. Third, the server processes the request via the vulnerable toocheke_series_bg_color_save() function, storing the raw payload directly into the database as post meta. Fourth, an administrator or higher-privileged user navigates to the series list table in the WordPress admin dashboard. Finally, the plugin renders the stored meta value directly into the style attribute of the administrative table, causing the injected script to execute in the victim's browser session with administrative privileges, thereby facilitating post-exploitation activities such as session hijacking or unauthorized administrative modifications."
}