CVE-2026-15604 is a stored cross-site scripting vulnerability in the Toocheke Companion WordPress plugin (<=2.10). The flaw exists because the toocheke_series_bg_color_save() function stores unsanitized user input from the 'series_bg_color' post meta field, and the stored value is later output in the admin series list table without proper escaping (missing esc_attr()). This allows authenticated attackers with contributor or higher privileges to inject arbitrary JavaScript that executes in the context of the WordPress admin dashboard when the series list table is viewed.

An attacker with contributor-level or higher privileges can inject malicious scripts that execute in the administrator's browser when viewing the series list table. This can lead to privilege escalation, theft of administrative session tokens, or other actions within the admin context. The vulnerability does not require user interaction beyond viewing the affected admin page and does not impact availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and avoid viewing the series list table in the admin dashboard if possible. Monitor for updates from the Toocheke plugin vendor regarding patches or official fixes.