CVE-2025-15694 in Table Of Contents Plugin
Summary
by MITRE • 09/05/2026
The Joli Table Of Contents WordPress plugin before 2.8.1 does not sanitise and escape some of its settings before outputting them in an admin page, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed, for example in a multisite setup.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/05/2026
The vulnerability identified in Joli Table Of Contents WordPress plugin versions prior to 2.8.1 represents a significant security flaw rooted in improper input validation and output encoding mechanisms within the administrative interface. Specifically, the application fails to properly sanitize user-supplied data before storing it and subsequently escapes this data inadequately when rendering it on admin pages. This architectural weakness allows for Stored Cross-Site Scripting attacks, which are particularly dangerous because the malicious script payload is saved in the database rather than being passed via a single request as seen in reflected XSS scenarios. The persistence of the code means that every time an administrator or any user with sufficient privileges accesses the affected admin page, the injected JavaScript executes automatically within their browser session context.
The severity of this vulnerability is amplified by its ability to bypass standard WordPress security controls designed to prevent HTML injection. In typical WordPress configurations, administrators are restricted from using certain tags and attributes through capability checks such as unfiltered_html. However, because Joli Table Of Contents does not enforce strict sanitization on specific settings fields before storage, it effectively creates a backdoor for script execution that circumvents these protective measures. This is especially critical in multisite environments where the unfiltered_html capability is often disabled by default to maintain security across multiple sub-sites. The flaw allows an attacker with administrative privileges to inject arbitrary JavaScript code that will persist and execute upon subsequent visits, potentially leading to session hijacking, credential theft via keyloggers, or defacement of the admin interface if combined with other vectors.
From a technical perspective, this issue aligns closely with CWE-79, which classifies Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific failure lies in the lack of proper escaping functions such as esc_html or wp_kses_post when outputting user-controlled data into HTML attributes or text nodes within the admin dashboard. Furthermore, the storage aspect ties directly to CWE-83, where untrusted data is stored without validation and later used by a web application in a way that enables injection attacks. The operational impact extends beyond simple script execution; it compromises the integrity of the administrative environment, potentially allowing attackers to manipulate site settings, steal cookies containing authentication tokens, or redirect users to malicious external sites for phishing purposes.
Mitigation strategies must focus on immediate remediation and long-term secure coding practices. Administrators using versions earlier than 2.8.1 should upgrade to the latest patched version immediately to resolve these input validation gaps. For organizations unable to update instantly due to compatibility constraints, temporary workarounds might include restricting access to the affected plugin settings pages or disabling the specific functionality if not required. Developers and security auditors reviewing similar plugins must ensure that all user inputs are strictly sanitized using appropriate WordPress functions like sanitize_text_field before database insertion and escaped using context-aware output escaping techniques when rendering data in HTML contexts. Adhering to these practices ensures compliance with OWASP Top 10 standards regarding injection flaws and reinforces the principle of least privilege by ensuring that even high-privilege users cannot inadvertently execute untrusted code through misconfigured or vulnerable plugin settings.