Executive brief
The Joli Table Of Contents WordPress plugin fails to properly escape user-configurable settings before displaying them in the admin interface. An administrator can inject malicious JavaScript code into plugin settings, which then executes in the browsers of other administrators or site owners who view the settings page, enabling account compromise or unauthorized actions in WordPress.
Technical details
This is a Stored Cross-Site Scripting (XSS) vulnerability caused by insufficient output escaping in the admin settings display. The vulnerable component is the "Headings overflow" select field, which accepts and stores unsanitized input via sanitize_text_field (which preserves HTML attributes and quotes). When the settings page is rendered, the stored value is directly echoed into a data-selected-value HTML attribute without escaping, allowing an attacker to break out of the attribute and inject arbitrary event handlers (e.g., onmouseover). Attack requires admin-level privileges and is particularly effective in WordPress multisite environments where administrators lack the unfiltered_html capability. The injected payload executes in the context of any high-privilege user viewing the settings page. Fixed in version 2.8.1.
Affected products
- Joli Table Of Contents 2.0.0 to 2.8.0
Timeline
- 2026-09-03: disclosed
- 2026-09-05: patched: Fixed in version 2.8.1