Executive brief
The Joli Table Of Contents WordPress plugin is used to automatically generate a table of contents for posts. The plugin fails to sanitize user input in shortcode attributes before rendering them in HTML, allowing authors and higher-privileged users to inject malicious JavaScript that executes when any user—including administrators—views the affected post. This bypasses WordPress's content filtering and creates a privilege escalation vulnerability.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in shortcode attribute handling. The plugin does not escape or sanitize values from shortcode attributes (such as "theme", "toc_title_alignment", "toc_alignment", "toggle_style", and "toggle_position") before inserting them into HTML element attributes. An attacker with Author role can inject JavaScript via these attributes; WordPress's KSES content filter does not strip shortcode attribute values, so the payload persists in the database. When rendered, the unescaped attribute breaks out of its intended context and injects arbitrary HTML and event handlers that execute in the browser of any viewer, including administrators. The plugin version 3.0.3 and later patch this issue.
Affected products
- Joli Table Of Contents before 3.0.3
Timeline
- 2026-09-03: disclosed
- 2026-09-05: patched: Version 3.0.3 fixes the vulnerability
- 2026-09-05: advisory: CVE-2026-84931 published