Toocheke Companion
Monthly
Stored Cross-Site Scripting in the Toocheke Companion WordPress plugin (versions up to and including 2.10) allows authenticated contributors to inject persistent malicious scripts that execute in the WordPress admin dashboard. The vulnerability arises from a two-stage failure: the `toocheke_series_bg_color_save()` function stores raw, unsanitized POST input, and the series admin column renderer concatenates that value directly into a style attribute without `esc_attr()` escaping. When a site administrator views the series list table, the stored payload executes in their browser context, enabling session hijacking, credential theft, or further privilege escalation within the WordPress installation. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
A DOM-based Cross-Site Scripting (XSS) vulnerability exists in Toocheke Companion browser extension versions through 1.194, allowing authenticated attackers to inject malicious scripts that execute in the context of a user's web session. An attacker with login credentials can craft malicious input that bypasses input sanitization during web page generation, enabling session hijacking, credential theft, or malware distribution. While no active KEV exploitation or public proof-of-concept has been disclosed for this CVE, the CVSS 6.5 score reflects moderate severity due to the requirement for user interaction and authenticated access.
Stored Cross-Site Scripting in the Toocheke Companion WordPress plugin (versions up to and including 2.10) allows authenticated contributors to inject persistent malicious scripts that execute in the WordPress admin dashboard. The vulnerability arises from a two-stage failure: the `toocheke_series_bg_color_save()` function stores raw, unsanitized POST input, and the series admin column renderer concatenates that value directly into a style attribute without `esc_attr()` escaping. When a site administrator views the series list table, the stored payload executes in their browser context, enabling session hijacking, credential theft, or further privilege escalation within the WordPress installation. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
A DOM-based Cross-Site Scripting (XSS) vulnerability exists in Toocheke Companion browser extension versions through 1.194, allowing authenticated attackers to inject malicious scripts that execute in the context of a user's web session. An attacker with login credentials can craft malicious input that bypasses input sanitization during web page generation, enabling session hijacking, credential theft, or malware distribution. While no active KEV exploitation or public proof-of-concept has been disclosed for this CVE, the CVSS 6.5 score reflects moderate severity due to the requirement for user interaction and authenticated access.