WordPress Toocheke Companion plugin contains a DOM-based Cross‑Site Scripting vulnerability caused by improper neutralization of input during web page generation, identified as CWE‑79. The flaw allows attacker‑controlled script to execute in the victim’s browser, potentially enabling arbitrary script execution within the context of the page.

The affected product is the Toocheke Companion plugin for WordPress, from any unspecified version through version 1.194. All installations using 1.194 or earlier are susceptible to this issue. No later versions are listed in the CVE data.

The CVSS base score is 6.5, rating the vulnerability as moderate severity. The EPSS score is less than 1%, indicating a low probability of exploitation in the near term, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Based on the description it is inferred that exploitation requires a victim to load a web page that incorporates attacker‑controlled data into the DOM, typically via a crafted URL or malicious link, and then execute the injected script with the privileges of the page.