CVE-2025-58857
BaseFortify
Publication date: 2025-09-05
Last updated on: 2026-04-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| kaizencoders | table_of_content | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Cross Site Request Forgery (CSRF) issue in the WordPress Table of Content Plugin up to version 1.5.3.1. It allows an attacker to trick authenticated users with higher privileges into performing unwanted actions on the site without their consent, potentially compromising site security. The vulnerability is related to broken access control and has a CVSS score of 7.1, indicating a low severity level. [1]
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized actions being executed on your website by attackers who exploit authenticated users with higher privileges. This can compromise the security of your site, potentially allowing attackers to manipulate content, change settings, or perform other harmful actions. Since the plugin is abandoned and unpatched, the risk remains unless mitigated by virtual patching or removing the plugin. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability is challenging because plugin-based malware scanners may be unreliable. There are no specific commands provided for detection. It is recommended to monitor for unusual actions by authenticated users and consider professional incident response services if compromise is suspected. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include applying a virtual patch (vPatch) provided by Patchstack to auto-mitigate the vulnerability, as no official fix or patched version is available. Additionally, it is recommended to remove and replace the vulnerable Table of Content plugin with an alternative plugin due to lack of ongoing support. Deactivating the plugin alone does not eliminate the security risk. [1]