EUVD-2026-71872
GHSA-m8wm-hf9g-3f6p
Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Author role is PR:L not PR:H; stored XSS crosses scope boundary into admin browser (S:C), enabling full session takeover.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Joli Table Of Contents WordPress plugin before 3.0.3 does not sanitise or escape a shortcode attribute value before outputting it inside an HTML element's attribute, allowing users with the Author role and above to inject arbitrary HTML attributes and JavaScript that execute in the browser of any user who views the post, including higher-privileged users such as administrators. This crosses a privilege boundary even on multisite, where such users are not permitted to post unfiltered HTML.
AnalysisAI
Stored cross-site scripting in the Joli Table Of Contents WordPress plugin (versions before 3.0.3) permits any user holding the Author role or higher to inject arbitrary HTML attributes and JavaScript via an unsanitized shortcode attribute, with the payload executing in the browser of any visitor - including administrators - who views the post. Because Authors in WordPress are explicitly barred from posting unfiltered HTML, this constitutes a privilege-boundary violation that can be leveraged to hijack administrator sessions or trigger privileged actions covertly. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an active WordPress installation running Joli Table Of Contents prior to version 3.0.3, with the attacker authenticated as a user holding at minimum the Author role (registered, low-privilege account). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 3.1 score of 6.8 (PR:H/UI:R/S:U) contains a metric inconsistency: the WordPress Author role maps to low privilege (PR:L in CVSS terminology), not PR:H (administrator-equivalent), which would raise the base score and better reflect the privilege escalation dynamic. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Joli Table Of Contents plugin to version 3.0.3 or later, which introduces proper sanitization and escaping of shortcode attribute values before HTML rendering. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Joli Table Of Contents
View allStored Cross-Site Scripting in the Joli Table Of Contents WordPress plugin (versions up to and including 2.8.0) allows a
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in v
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today