CVE-2026-84931

The Joli Table of Contents WordPress plugin (before 3.0.3 ) contains a stored XSS vulnerability in its shortcode handler. The plugin fails to sanitise or escape a shortcode attribute value before outputting it inside an HTML element's attribute. This allows users with the Author role (or above) t...

EUVD-2025-210850

The Joli Table Of Contents WordPress plugin before 2.8.1 does not sanitise and escape some of its settings before outputting them in an admin page, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability ...