CVE-2025-15694

Received Received - Intake

Stored XSS in Joli Table Of Contents WordPress Plugin

Publication date: 2026-09-05

Last updated on: 2026-09-06

Assigner: WPScan

Description

The Joli Table Of Contents WordPress plugin before 2.8.1 does not sanitise and escape some of its settings before outputting them in an admin page, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed, for example in a multisite setup.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-05

Last Modified

2026-09-06

Generated

2026-09-25

AI Q&A

2026-09-05

EPSS Evaluated

2026-09-24

NVD

CVE-2025-15694

EUVD

EUVD-2025-210850

Affected Vendors & Products

Vendor	Product	Version / Range
joli_table_of_contents	plugin	to 2.8.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

The Joli Table Of Contents WordPress plugin before version 2.8.1 has a stored Cross-Site Scripting (XSS) vulnerability. This occurs because the plugin does not properly sanitize and escape certain settings before displaying them in an admin page. High-privilege users, such as administrators, can exploit this to inject malicious scripts even if the unfiltered_html capability is restricted.

Detection Guidance

Check the installed version of the Joli Table Of Contents plugin. If it is between 2.0.0 and 2.8.0, the system is vulnerable. Use WordPress admin panel or run a command like 'wp plugin list' in the WordPress directory to verify the version.

Impact Analysis

This vulnerability allows attackers with high privileges to inject malicious scripts into admin pages. These scripts could steal sensitive data, perform unauthorized actions, or take control of the WordPress site. Users with administrative access could unknowingly execute these scripts, leading to potential data breaches or site compromise.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by allowing unauthorized access to sensitive user data. If exploited, it may result in data breaches that violate privacy regulations, leading to legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Update the Joli Table Of Contents plugin to version 2.8.1 or later immediately. Disable the plugin temporarily if an update is not possible, but ensure to back up data before doing so.

Hi! I’m here to help you understand CVE-2025-15694. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70