CVE-2025-15694: Joli Table Of Contents XSS Vulnerability

CVE-2025-15694 Overview

CVE-2025-15694 is a Stored Cross-Site Scripting (XSS) vulnerability in the Joli Table Of Contents WordPress plugin versions prior to 2.8.1. The plugin fails to sanitise and escape several of its settings before rendering them in an admin page. High-privilege users such as administrators can inject arbitrary JavaScript that executes in the context of other administrators. The issue is significant in WordPress multisite environments where the unfiltered_html capability is intentionally disallowed to constrain what site administrators can inject. The vulnerability is tracked under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact

An administrator with restricted unfiltered_html privileges can store JavaScript that executes against super administrators, enabling account takeover in multisite deployments.

Affected Products

• Joli Table Of Contents WordPress plugin versions prior to 2.8.1
• WordPress multisite installations where the plugin is active
• Any WordPress site relying on the unfiltered_html capability restriction for administrators

Discovery Timeline

• 2026-09-05 - CVE-2025-15694 published to NVD
• 2026-09-08 - Last updated in NVD database

Technical Details for CVE-2025-15694

Vulnerability Analysis

The Joli Table Of Contents plugin exposes configuration settings through a WordPress admin page. Values submitted through those settings are stored in the database and rendered back into the admin interface without proper output encoding. When an attacker submits input containing HTML or JavaScript payloads, those payloads are persisted and later executed in the browser of any administrator who visits the settings screen.

The vulnerability requires high privileges to exploit and user interaction from the victim, which limits its usefulness in single-site WordPress installations where administrators already possess unfiltered_html. In multisite installations, however, the unfiltered_html capability is stripped from site administrators to prevent them from injecting scripts that could affect the wider network. This flaw effectively bypasses that restriction. A malicious site administrator can pivot to compromise a super administrator session and escalate control across the network.

Root Cause

The root cause is missing output escaping when plugin settings are echoed into the admin page HTML. WordPress provides helper functions such as esc_attr(), esc_html(), and wp_kses() for this purpose. The affected code paths fail to apply them, allowing raw attacker-controlled markup to reach the DOM.

Attack Vector

An authenticated administrator submits a payload through the plugin's settings form. The payload is stored and rendered without escaping the next time the settings page is loaded. Any administrator viewing the page triggers execution of the injected script under the origin of the WordPress admin dashboard. See the WPScan Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-15694

Indicators of Compromise

• Unexpected <script> tags, event handlers (onerror, onload), or javascript: URIs stored in plugin option rows within the wp_options table.
• New or modified administrator accounts created shortly after an administrator visited the Joli Table Of Contents settings page.
• Outbound HTTP requests from admin browser sessions to attacker-controlled domains referenced by the plugin settings.

Detection Strategies

• Audit the plugin's stored options for HTML markup or scripting syntax that should not appear in configuration text fields.
• Review WordPress access logs for POST requests to wp-admin/options.php or the plugin's settings endpoint originating from lower-trust administrator accounts.
• Correlate settings-page visits by super administrators with subsequent privileged actions such as user creation or role changes.

Monitoring Recommendations

• Enable WordPress audit logging to capture option updates, user role changes, and plugin configuration events.
• Alert on any administrator account performing privileged changes within minutes of viewing the plugin settings page.
• Monitor for installation of unfamiliar plugins or themes following suspected exploitation, which is a common post-XSS persistence step.

How to Mitigate CVE-2025-15694

Immediate Actions Required

• Update the Joli Table Of Contents plugin to version 2.8.1 or later on every site in the network.
• Inspect existing plugin settings for stored payloads and remove any script or HTML content that should not be there.
• Rotate credentials and review recent activity for accounts with the Administrator or Super Administrator role.

Patch Information

The vendor addressed CVE-2025-15694 in Joli Table Of Contents version 2.8.1 by sanitising and escaping settings values before output. Refer to the WPScan Vulnerability Report for advisory details and the fixed release reference.

Workarounds

• Restrict access to the plugin settings page to trusted super administrators only until the update is applied.
• Deactivate the plugin on multisite networks where site administrators are not fully trusted.
• Deploy a web application firewall rule to block script-like input submitted to the plugin's settings endpoint.

# Update the plugin via WP-CLI across a multisite network
wp plugin update joli-table-of-contents --network
wp plugin get joli-table-of-contents --field=version