Stored Cross-Site Scripting Vulnerability in Joli Table Of Contents Plugin for WordPress
CVE-2025-15694
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 5 September 2026
Badges
What is CVE-2025-15694?
The Joli Table Of Contents WordPress plugin versions prior to 2.8.1 are susceptible to a Stored Cross-Site Scripting vulnerability. This flaw arises from the failure to properly sanitize and escape certain settings when rendering in the admin interface. As a result, users with elevated privileges, such as administrators, may inadvertently be exploited through crafted input, facilitating Stored XSS attacks. This vulnerability is particularly concerning in multisite environments where the unfiltered_html capability is restricted, allowing exploiters to potentially execute malicious scripts that compromise site integrity.
Affected Version(s)
Joli Table Of Contents 2.0.0 < 2.8.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.