This vulnerability (CVE-2026-66645) is a CWE-79 Cross-site Scripting (XSS) flaw in the WPDeveloper Table Of Contents Block plugin for WordPress. It affects versions up to and including 1.5.0. The issue arises from improper neutralization of input during web page generation, which can be exploited by a contributor-level user to execute arbitrary scripts in the context of the affected site. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, required privileges of a contributor, user interaction required, and impacts to confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and no known exploits have been reported.

Successful exploitation could allow an attacker with contributor privileges to execute arbitrary scripts in the context of the vulnerable web application, potentially leading to partial compromise of confidentiality, integrity, and availability of the affected system. This could include actions such as session hijacking, defacement, or other malicious activities within the scope of the contributor's permissions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit contributor privileges where possible and monitor for suspicious activity related to the Table Of Contents Block plugin. Avoid granting contributor access to untrusted users.