EUVD-2025-210850
GHSA-w6q9-cjvw-4mhm
Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
Administrator authentication required to store payload (PR:H), victim admin must view page (UI:R), scope unchanged within same application, impact limited to session-level confidentiality and integrity.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Joli Table Of Contents WordPress plugin before 2.8.1 does not sanitise and escape some of its settings before outputting them in an admin page, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed, for example in a multisite setup.
AnalysisAI
Stored Cross-Site Scripting in the Joli Table Of Contents WordPress plugin (versions up to and including 2.8.0) allows authenticated administrator-level users to inject persistent malicious scripts into admin settings pages that execute in the browsers of other administrators who view those pages. The vulnerability bypasses WordPress's unfiltered_html capability restriction, making it particularly relevant in WordPress multisite deployments where that capability is intentionally withheld from site administrators. A vendor-released patch (2.8.1) is available, and a public proof-of-concept has been published by WPScan.
Technical ContextAI
The Joli Table Of Contents plugin is a WordPress table-of-contents generator. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), where plugin-controlled settings values are written to the database without server-side sanitization and are subsequently output into admin-facing HTML pages without proper escaping. WordPress's unfiltered_html capability normally governs whether a user may post raw HTML, but plugins that independently persist and render settings data can circumvent this control if they fail to apply wp_kses or esc_html to stored values before rendering. The affected product is identified under CPE cpe:2.3:a:unknown:joli_table_of_contents:*:*:*:*:*:*:*:* (affected range: 2.0.0 through 2.8.0 inclusive). The ENISA EUVD tracks this as EUVD-2025-210850.
RemediationAI
Update the Joli Table Of Contents plugin to version 2.8.1 or later, which introduces proper sanitization and escaping of settings values before rendering on admin pages. The fix is confirmed as available from the vendor per the WPScan advisory at https://wpscan.com/vulnerability/9ebaf1aa-eb8b-4c62-bbd0-07918503fbf1/. For environments that cannot immediately update, a compensating control is to restrict access to the affected plugin settings pages using a Web Application Firewall rule that blocks stored-content injection patterns targeting wp-admin endpoints, though this approach has limited effectiveness against stored payloads already in the database. In WordPress multisite deployments, temporarily removing plugin-management capability from site-level admins reduces the attack surface until the patch is applied, at the cost of disrupting legitimate administrative workflows.
More in Joli Table Of Contents
View allStored cross-site scripting in the Joli Table Of Contents WordPress plugin (versions before 3.0.3) permits any user hold
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in v
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today