PT-2026-86317

CVE-2025-15694

Published

2026-09-03

Updated

2026-09-06

Description by

CVSS 3.1

3.5

Low

MetricsAV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Joli Table Of Contents versions 2.0.0 through 2.8.0

Description Insufficient input sanitization and output escaping in the plugin allow high-privilege users, such as administrators, to perform Stored Cross-Site Scripting (XSS) attacks. This occurs when settings are outputted on an admin page, enabling the injection of arbitrary web scripts that execute when a user accesses the affected page. This issue specifically impacts multi-site installations and environments where the unfiltered html capability is disabled.

Recommendations Update Joli Table Of Contents to version 2.8.1 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Krugov Artyom

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers