CVE-2025-15694: Joli Table Of Contents 2.0.0 - 2.8.0 - Admin+ Stored XSS
The Joli Table Of Contents WordPress plugin before 2.8.1 does not sanitise and escape some of its settings before outputting them in an admin page, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed, for example in a multisite setup.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated high-privilege user, such as an administrator, must be able to modify the affected plugin settings. The issue is specifically relevant where such users do not have the unfiltered_html capability, such as in some WordPress multisite deployments.
Which plugin versions are affected?
Joli Table Of Contents versions 2.0.0 through 2.8.0 are affected. Version 2.8.1 is not identified as affected.
Where does the malicious script execute?
The vulnerable settings are output on an administrative page, so the stored script payload executes when that affected admin page is viewed.