CyberRota Analysis
AI-GeneratedThe Joli Table Of Contents WordPress plugin prior to version 2.8.1 is vulnerable due to inadequate sanitization and escaping of settings on its admin page, potentially enabling high-privilege users, including administrators, to execute Stored Cross-Site Scripting (XSS) attacks. This vulnerability poses a significant risk in environments where the unfiltered_html capability is restricted, such as multisite configurations. WordPress site administrators and security teams should prioritize updating the plugin to mitigate this risk.
Original NVD Description
The Joli Table Of Contents WordPress plugin before 2.8.1 does not sanitise and escape some of its settings before outputting them in an admin page, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed, for example in a multisite setup.