CVE-2025-2299 affects the LuckyWP Table of Contents plugin for WordPress, where the 'ajaxEdit' function lacks proper nonce validation, enabling Cross-Site Request Forgery attacks. An attacker can exploit this by crafting a forged request that, when executed by a site administrator (e.g., via clicking a link), results in arbitrary script injection. This vulnerability is categorized under CWE-79, reflecting improper input neutralization leading to Cross-site Scripting. The CVSS 3.1 score of 6.1 reflects a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, and partial confidentiality and integrity impact. No patch or official fix details are currently available.

Successful exploitation allows an unauthenticated attacker to perform Cross-Site Request Forgery that results in arbitrary script injection when a site administrator is tricked into executing a forged request. This can lead to partial confidentiality and integrity impacts on the affected WordPress site. There is no indication of availability impact or known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution with links and requests related to the LuckyWP Table of Contents plugin, especially avoiding clicking untrusted links. Monitoring vendor channels for updates and applying patches promptly once released is recommended.