7 matches found
CVE-2026-84931
The Joli Table Of Contents WordPress plugin, in versions prior to 3.0.3 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to sanitize or escape a shortcode attribute value before it is outputted inside an HTML element's attribute. This allows users with the Auth...
CVE-2026-84931 Joli Table Of Contents < 3.0.3 - Author+ Stored XSS via joli-toc Shortcode Theme Attribute
The Joli Table Of Contents WordPress plugin before 3.0.3 does not sanitise or escape a shortcode attribute value before outputting it inside an HTML element's attribute, allowing users with the Author role and above to inject arbitrary HTML attributes and JavaScript that execute in the browser of...
CVE-2026-84931 Joli Table Of Contents < 3.0.3 - Author+ Stored XSS via joli-toc Shortcode Theme Attribute
The Joli Table Of Contents WordPress plugin before 3.0.3 does not sanitise or escape a shortcode attribute value before outputting it inside an HTML element's attribute, allowing users with the Author role and above to inject arbitrary HTML attributes and JavaScript that execute in the browser of...
EUVD-2025-210850
The Joli Table Of Contents WordPress plugin before 2.8.1 does not sanitise and escape some of its settings before outputting them in an admin page, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability ...
CVE-2025-15694 Joli Table Of Contents 2.0.0 - 2.8.0 - Admin+ Stored XSS
The Joli Table Of Contents WordPress plugin before 2.8.1 does not sanitise and escape some of its settings before outputting them in an admin page, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability ...
CVE-2025-15694 Joli Table Of Contents 2.0.0 - 2.8.0 - Admin+ Stored XSS
The Joli Table Of Contents WordPress plugin before 2.8.1 does not sanitise and escape some of its settings before outputting them in an admin page, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability ...
PT-2026-86317
šØ CVE-2025-15694 The Joli Table Of Contents WordPress plugin before 2.8.1 does not sanitise and escape some of its settings before outputting them in an admin page, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfiltere...