Skip to content
Sign in
3.5 Low

CVE-2025-15694 The Joli Table Of Contents WordPress plugin before 2.8.1 does not sanitise and escape some of its settings before…

Description

The Joli Table Of Contents WordPress plugin before 2.8.1 does not sanitise and escape some of its settings before outputting them in an admin page, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed, for example in a multisite setup.

Affected products and versions

Product Affected versions Fixed in
Joli Table Of Contents 2.0 2.0.0 → < 2.8.1 2.8.1

Other CVEs of Joli Table Of Contents

The 2 CVEs of Joli Table Of Contents →
CVE-2026-84931 The Joli Table Of Contents WordPress plugin before 3.0.3 does not sanitise or escape a shortcode attribute value… 6.8 Medium
Track this CVE