CVE-2025-15694
Received Received - Intake

Stored XSS in Joli Table Of Contents WordPress Plugin

Publication date: 2026-09-05

Last updated on: 2026-09-05

Assigner: WPScan

Description
The Joli Table Of Contents WordPress plugin before 2.8.1 does not sanitise and escape some of its settings before outputting them in an admin page, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed, for example in a multisite setup.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-05
Last Modified
2026-09-05
Generated
2026-09-05
AI Q&A
2026-09-05
EPSS Evaluated
N/A
NVD
CVE-2025-15694
EUVD
EUVD-2025-210850

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
joli_table_of_contents plugin to 2.8.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Joli Table Of Contents WordPress plugin before version 2.8.1 has a stored Cross-Site Scripting (XSS) vulnerability. This occurs because the plugin does not properly sanitize and escape certain settings before displaying them in an admin page. High-privilege users, such as administrators, can exploit this to inject malicious scripts even if the unfiltered_html capability is restricted.

Detection Guidance

Check the installed version of the Joli Table Of Contents plugin. If it is between 2.0.0 and 2.8.0, the system is vulnerable. Use WordPress admin panel or run a command like 'wp plugin list' in the WordPress directory to verify the version.

Impact Analysis

This vulnerability allows attackers with high privileges to inject malicious scripts into admin pages. These scripts could steal sensitive data, perform unauthorized actions, or take control of the WordPress site. Users with administrative access could unknowingly execute these scripts, leading to potential data breaches or site compromise.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by allowing unauthorized access to sensitive user data. If exploited, it may result in data breaches that violate privacy regulations, leading to legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Update the Joli Table Of Contents plugin to version 2.8.1 or later immediately. Disable the plugin temporarily if an update is not possible, but ensure to back up data before doing so.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-15694. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart