CVE-2025-15694: CWE-79 Cross-Site Scripting (XSS) in Joli Table Of Contents

The Joli Table Of Contents WordPress plugin before version 2.8.1 contains a stored Cross-Site Scripting vulnerability (CWE-79) due to improper sanitization and escaping of some settings output on an admin page. This allows users with high privileges (e.g., administrators) to inject persistent malicious scripts despite restrictions on unfiltered_html capability, potentially impacting multisite environments. The vulnerability is identified as CVE-2025-15694 with a CVSS 3.1 base score of 3.5 (low severity). There is no vendor advisory or patch information currently available, and no known exploits have been reported in the wild.

The vulnerability allows high-privilege users to perform stored XSS attacks in the WordPress admin interface. This could lead to execution of arbitrary scripts within the context of the admin page, potentially enabling actions such as session hijacking or unauthorized administrative actions. However, the impact is limited by the requirement of high privileges and the low CVSS score indicates limited overall risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrative access to trusted users only and monitor for suspicious activity. Avoid enabling unfiltered_html capability for users if possible.