CVE-2026-84931: CWE-79 Cross-Site Scripting (XSS) in Joli Table Of Contents

The Joli Table Of Contents WordPress plugin versions prior to 3.0.3 contain a CWE-79 Cross-Site Scripting vulnerability. Specifically, the plugin does not properly sanitize or escape shortcode attribute values before embedding them into HTML element attributes. This flaw enables users with Author role or above to inject malicious HTML attributes and JavaScript code that executes in the context of any user viewing the affected post, including higher-privileged users such as administrators. This represents a privilege escalation vector, particularly impactful in multisite environments where Authors are restricted from posting unfiltered HTML.

Successful exploitation allows an attacker with Author-level privileges or higher to execute arbitrary JavaScript in the browsers of users who view the affected post, including administrators. This can lead to theft of sensitive information, session hijacking, or other malicious actions performed with the privileges of the victim user. The vulnerability crosses privilege boundaries and affects multisite WordPress setups where Authors normally cannot post unfiltered HTML, increasing the risk of privilege escalation and persistent cross-site scripting attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a fix is available, restrict Author-level users from adding shortcodes or consider disabling the Joli Table Of Contents plugin if possible. Monitor vendor channels for updates and apply any official patches promptly once released.