CVE-2025-15694

Name of the Vulnerable Software and Affected Versions Joli Table Of Contents versions 2.0.0 through 2.8.0

Description Insufficient input sanitization and output escaping in the plugin allow high-privilege users, such as administrators, to perform Stored Cross-Site Scripting (XSS) attacks. This occurs when settings are outputted on an admin page, enabling the injection of arbitrary web scripts that execute when a user accesses the affected page. This issue specifically impacts multi-site installations and environments where the unfiltered html capability is disabled.

Recommendations Update Joli Table Of Contents to version 2.8.1 or later.