Easy Table of Contents < 2.0.66 - Admin+ Stored XSS

2024-06-0500:00:00

Dmitrii Ignatyev

plugin security settings exploit

stored xss

js code injection

unfiltered html disallowance

5.9 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

You should create new post with two more heading. Go to the settings of the plugin and change "ez-toc-settings[heading_text_tag]" field to "Malicious JS code eval() and etc. For example img src=x onerror=alert(1)" -> Save Settings (Admins and editors are allowed to use JS in posts/pages/comments/etc, so the unfiltered_html capability should be disallowed when testing for Stored XSS using such roles)