CVE-2026-15604

Toocheke Companion <= 2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'series_bg_color' Post Meta

The Toocheke Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.10 via the 'series_bg_color' post meta field. This is due to insufficient input sanitization in the toocheke_series_bg_color_save() function (which stores the raw $_POST value in post meta) and insufficient output escaping in the series admin column rendering (where the stored value is concatenated into a style attribute without esc_attr()). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user, such as an administrator, accesses the series list table in the admin dashboard.

We have discovered 287 live websites that are affected by CVE-2026-15604.

Run a Free Instant Scan



Affected Software

Product  Toocheke Companion
Category Wordpress Plugins
Vulnerable Domains287 live websites (86% of Toocheke Companion install base)
Vulnerable Versions
  • from 0 through 2.10
Vulnerable Versions Count30 versions ( 79% of all versions)


Common Weakness Enumeration

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')



Details

  • Published - Aug 16, 2026
  • Updated - Aug 18, 2026

Credits

  • Wordfence PRISM (finder)

Website Distribution by Country

Number of websites using CVE-2026-15604
United States206 websites


Germany22 websites
Cyprus11 websites
France7 websites
Canada5 websites
GB5 websites
Denmark4 websites
Japan2 websites
Netherlands2 websites

Website Distribution by TLD

Number of websites using CVE-2026-15604
.com248 websites
.net13 websites
.de4 websites
.org4 websites
.co2 websites
.co.uk2 websites
.ca1 websites
.es1 websites
.fi1 websites
.fr1 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-15604

Top websites that are affected by CVE-2026-15604. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
*********.com United States***,***
************.com United States***,***
*************.com United States***,***
**********.com United States***,***
***.co United States*,***,***
*********.com Netherlands*,***,***
*******************.com United States*,***,***
********.com Germany*,***,***
***********.com United States*,***,***
*******.net United States*,***,***
See full domain list

FAQ

CVE-2026-15604 is Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Toocheke Companion
A total of 287 websites have been identified as vulnerable to CVE-2026-15604, based on global website indexing conducted by WebTechSurvey.
The Toocheke Companion is affected by the CVE-2026-15604 vulnerability.
Toocheke Companion versions up to and including 2.10 are vulnerable to CVE-2026-15604.