Table Of Contents Block
Monthly
Stored Cross-Site Scripting in the WordPress Table Of Contents Block plugin (versions up to and including 1.5.0) allows authenticated users with at least Contributor-level access to inject arbitrary JavaScript into post content via the block editor. Because the CVSS vector carries a changed scope (S:C), the injected payload executes in the browser context of any user - including administrators - who views the affected page, enabling session hijacking or privilege escalation. No public exploit code or CISA KEV listing is present in the available data, but the low attack complexity and broad administrator victim surface make this a meaningful risk for multi-author WordPress deployments.
Stored Cross-Site Scripting in the WordPress Table Of Contents Block plugin (versions up to and including 1.5.0) allows authenticated users with at least Contributor-level access to inject arbitrary JavaScript into post content via the block editor. Because the CVSS vector carries a changed scope (S:C), the injected payload executes in the browser context of any user - including administrators - who views the affected page, enabling session hijacking or privilege escalation. No public exploit code or CISA KEV listing is present in the available data, but the low attack complexity and broad administrator victim surface make this a meaningful risk for multi-author WordPress deployments.