The vulnerability resides in the Toocheke Companion plugin for WordPress and allows an attacker with Contributor or higher privileges to store malicious JavaScript via the 'series_bg_color' post meta field. The stored input is not sanitized when written to the database, and later it is concatenated directly into an HTML style attribute without proper escaping. Because the code runs within the admin area, the injected script executes in the context of any user who views the series list table, which may include administrators, thereby potentially allowing attackers to hijack sessions, deface pages, or exfiltrate data.

All installations of the Toocheke Companion plugin with versions 2.10 or earlier are affected. Users who have downgraded to older releases or who have not applied the latest 2.11 release remain vulnerable.

The CVSS score of 6.4 indicates a medium severity but not critical. No EPSS score is available, making it difficult to gauge current exploit prevalence, and the vulnerability is not listed in CISA KEV. Attackers only need Contributor-level access, which is common in many WordPress sites. The vulnerability is exploitable through normal usage of the plugin – a legitimate contributor can input a malicious value, and the script will run whenever a privileged user访问 the series list, making the risk actionable and relatively low‑friction.