WordPress plugin
Toocheke Companion security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 3 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High0
- Medium3
- Low0
All Toocheke Companion vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting via 'series_bg_color' Post Meta ≤2.10Update to 2.11 | CVE-2026-15604 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting ≤1.194Update to 1.195 | CVE-2026-32403 | |
| Medium4.4 | Authenticated (Admin+) Stored Cross-Site Scripting ≤1.166Update to 1.167 | CVE-2025-23992 |
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'series_bg_color' Post Meta
≤2.10Update to 2.11
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.194Update to 1.195
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤1.166Update to 1.167
Toocheke Companion: common questions
Does Toocheke Companion have known vulnerabilities?
Yes. VulnCrest Radar lists 3 known vulnerabilities in Toocheke Companion: 3 medium. None are known to affect version null.
How do I check which version of Toocheke Companion I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Toocheke Companion vulnerability?
CVE-2026-15604, published Aug 15, 2026: Toocheke Companion <= 2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'series_bg_color' Post Meta. Severity: Medium (CVSS 6.4).
Is any Toocheke Companion vulnerability listed in CISA KEV?
No. None of the known Toocheke Companion vulnerabilities is currently listed in the CISA KEV catalog.