What is the CVSS score of CVE-2026-15604?

CVE-2026-15604 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Toocheke Companion CVE-2026-15604

EUVD-2026-59893 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-08-16 Wordfence

GHSA-vrrh-33qv-f36q

WordPress XSS Toocheke Companion Wordpress Plugin

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

UI:R assigned because an administrator must actively visit the series list table to trigger the stored payload; all other provided metrics are retained as accurate.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 16, 2026 - 06:16 vuln.today

CVE Published

Aug 16, 2026 - 05:27 cve.org

MEDIUM 6.4

DescriptionCVE.org

The Toocheke Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.10 via the 'series_bg_color' post meta field. This is due to insufficient input sanitization in the toocheke_series_bg_color_save() function (which stores the raw $_POST value in post meta) and insufficient output escaping in the series admin column rendering (where the stored value is concatenated into a style attribute without esc_attr()). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user, such as an administrator, accesses the series list table in the admin dashboard.

AnalysisAI

Stored Cross-Site Scripting in the Toocheke Companion WordPress plugin (versions up to and including 2.10) allows authenticated contributors to inject persistent malicious scripts that execute in the WordPress admin dashboard. The vulnerability arises from a two-stage failure: the toocheke_series_bg_color_save() function stores raw, unsanitized POST input, and the series admin column renderer concatenates that value directly into a style attribute without esc_attr() escaping. When a site administrator views the series list table, the stored payload executes in their browser context, enabling session hijacking, credential theft, or further privilege escalation within the WordPress installation. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

This is a CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS) vulnerability with a dual root cause. The first failure occurs at write time: toocheke_series_bg_color_save() persists the raw $_POST['series_bg_color'] value to post meta without sanitization (e.g., sanitize_hex_color() or sanitize_text_field()). The second failure occurs at read time: the stored value is interpolated into an inline CSS style attribute in the admin column renderer without calling esc_attr(), allowing injected payloads to break out of the attribute context. The attack targets the WordPress admin dashboard's series list table, meaning the script runs in a privileged browser session. The affected software is identified via CPE cpe:2.3:a:toocheke:toocheke_companion:*:*:*:*:*:*:*:*, covering all releases through version 2.10. Plugin source references in WordPress Trac (tags/2.3 and tags/2.11) confirm the vulnerable code paths in class-toocheke-companion-metaboxes.php (lines 959-960) and class-toocheke-companion-admin-columns.php (line 296).

RemediationAI

The primary remediation is to update the Toocheke Companion plugin to version 2.11 or later, which is inferred from WordPress Trac tag references (https://plugins.trac.wordpress.org/browser/toocheke-companion/tags/2.11/inc/class-toocheke-companion-admin-columns.php#L296) as the first post-fix release; however, this version has not been confirmed via a dedicated vendor release advisory, so administrators should verify availability through the WordPress plugin repository. If an update is unavailable or cannot be applied immediately, two targeted compensating controls apply: first, remove or suspend all contributor-level (and above) accounts that are not operationally required, eliminating the authenticated entry point; second, restrict access to the WordPress admin dashboard to trusted IP ranges via server-level controls (e.g., .htaccess or firewall rules), which prevents the XSS payload from executing even if stored, since the trigger requires an admin to view the series list table. The trade-off of IP restriction is reduced operational flexibility for remote administrators. For the permanent fix, developers should apply sanitize_hex_color() to the $_POST['series_bg_color'] value in toocheke_series_bg_color_save() before storing it, and wrap the output in esc_attr() within the admin column renderer.