CVE-2026-84931: Joli Table Of Contents < 3.0.3 - Author+ Stored XSS via joli-toc Shortcode Theme Attribute
The Joli Table Of Contents WordPress plugin before 3.0.3 does not sanitise or escape a shortcode attribute value before outputting it inside an HTML element's attribute, allowing users with the Author role and above to inject arbitrary HTML attributes and JavaScript that execute in the browser of any user who views the post, including higher-privileged users such as administrators. This crosses a privilege boundary even on multisite, where such users are not permitted to post unfiltered HTML.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A user with the WordPress Author role or any higher-privileged role can exploit it by supplying a crafted value for the joli-toc shortcode theme attribute.
Which users are at risk from a malicious post?
Any user who views the affected post can have attacker-supplied JavaScript execute in their browser. This includes administrators, so viewing a malicious post can cross a privilege boundary.
Are WordPress multisite installations protected by restrictions on unfiltered HTML?
No. The issue can be exploited even on multisite installations where Authors are not allowed to post unfiltered HTML, because the vulnerable shortcode attribute is not properly sanitised or escaped.
What version resolves the issue?
Update Joli Table Of Contents to version 3.0.3 or later. Versions before 3.0.3 are affected.