CVE-2026-84931 in Table Of Contents Plugin
Summary
by MITRE • 09/05/2026
The Joli Table Of Contents WordPress plugin before 3.0.3 does not sanitise or escape a shortcode attribute value before outputting it inside an HTML element's attribute, allowing users with the Author role and above to inject arbitrary HTML attributes and JavaScript that execute in the browser of any user who views the post, including higher-privileged users such as administrators. This crosses a privilege boundary even on multisite, where such users are not permitted to post unfiltered HTML.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/05/2026
The vulnerability identified in Joli Table Of Contents WordPress plugin versions prior to 3.0.3 represents a critical cross-site scripting flaw rooted in insufficient input validation and output encoding mechanisms. Specifically, the defect lies within the handling of shortcode attribute values where the application fails to sanitize or escape user-supplied data before embedding it directly into HTML element attributes. This technical oversight allows an attacker with Author-level privileges or higher to inject arbitrary HTML attributes containing malicious JavaScript payloads. When a victim views a post crafted by such an attacker, the browser interprets the injected code as part of the page structure, leading to immediate execution within the context of the vulnerable site.
This vulnerability is particularly severe because it crosses privilege boundaries in ways that typically restrict unfiltered HTML content. In standard WordPress configurations and specifically on multisite installations, users with Author roles are generally prohibited from posting raw or unfiltered HTML due to security policies designed to prevent script injection. However, by exploiting this specific shortcode attribute handling flaw, an attacker can bypass these restrictions effectively. The injected JavaScript executes in the browser of any user who views the affected post, including administrators and other high-privileged users. This capability enables a wide range of malicious activities such as session hijacking, credential theft, defacement, or further propagation within the network if combined with additional exploitation techniques.
From an industry standards perspective, this vulnerability aligns closely with CWE-79, which categorizes improper neutralization of input during web page generation known commonly as cross-site scripting. The attack vector leverages a stored persistence mechanism where malicious content is saved in the database and subsequently rendered to victims without proper sanitization. In terms of tactical mapping within the MITRE ATT&CK framework for enterprise security, this behavior corresponds to techniques involving client-side code injection and potentially credential harvesting through session manipulation. The ability to execute arbitrary scripts as higher-privileged users significantly amplifies the risk profile beyond typical user-level exploits.
Mitigation strategies must prioritize immediate updates to version 3.0.3 or later of the Joli Table Of Contents plugin, where these input validation flaws have been addressed by developers implementing robust escaping and sanitization routines for all shortcode attributes. For organizations unable to patch immediately due to compatibility constraints, temporary workarounds should include restricting author-level access if feasible, employing Web Application Firewalls configured to detect and block script injection patterns in post content, and enforcing strict Content Security Policy headers that restrict inline script execution. Continuous monitoring of plugin updates and adherence to secure coding practices involving the principle of least privilege are essential for maintaining long-term resilience against such vulnerabilities.