CVE-2025-31385: Site Table of Contents CSRF Vulnerability

CVE-2025-31385 Overview

CVE-2025-31385 is a Cross-Site Request Forgery (CSRF) vulnerability in the Site Table of Contents WordPress plugin developed by intelcaprep. The flaw affects plugin versions up to and including 0.3 and enables Stored Cross-Site Scripting (XSS) when exploited. An attacker can craft a malicious request that, when triggered by an authenticated administrator, injects persistent JavaScript into the plugin's stored data. The injected payload then executes in the browser of any user who views the affected page. The vulnerability is categorized under CWE-352 and stems from missing CSRF protections on state-changing requests.

Critical Impact
Successful exploitation chains CSRF with Stored XSS, allowing attackers to execute arbitrary JavaScript in administrator sessions and potentially take over WordPress sites.

Affected Products

WordPress plugin: Site Table of Contents (slug site-table-of-contents)
Vendor: intelcaprep
Affected versions: from n/a through <= 0.3

Discovery Timeline

2025-04-09 - CVE-2025-31385 published to the National Vulnerability Database (NVD)
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-31385

Vulnerability Analysis

The vulnerability combines two distinct weaknesses into a single exploitation chain. The plugin processes state-changing requests without validating CSRF tokens, and the same request handlers fail to sanitize user-supplied input before storing it. An attacker hosts a malicious page that issues a forged request to the target WordPress site. When an authenticated administrator visits the attacker-controlled page, the browser submits the forged request with valid session cookies. The plugin accepts the request and writes the attacker-controlled payload to the database. Subsequent page renders inject the payload into the HTML, executing the attacker's JavaScript in every visitor's browser.

Root Cause

The root cause is the absence of nonce verification on plugin endpoints that mutate stored configuration. WordPress provides wp_nonce_field() and check_admin_referer() helpers for this purpose, but the Site Table of Contents plugin does not invoke them on the affected handlers. Additionally, input received from the request is persisted without escaping or filtering, which allows raw <script> content to reach the rendering layer.

Attack Vector

Exploitation requires user interaction from an authenticated administrator. The attacker delivers a link or embedded resource through phishing, a compromised site, or a malicious advertisement. Once triggered, the attack persists in the WordPress database and affects every subsequent visitor to the rendered page. No credentials are required from the attacker, since the victim's browser supplies the session context.

No public proof-of-concept code is available. Technical details are documented in the Patchstack Vulnerability Report.

Detection Methods for CVE-2025-31385

Indicators of Compromise

Unexpected <script>, <iframe>, or event-handler attributes stored in plugin configuration rows within the WordPress database
Outbound HTTP requests from visitor browsers to unfamiliar domains when loading pages that render the Site Table of Contents
Administrator audit log entries showing plugin settings changes that do not correspond to legitimate administrative activity

Detection Strategies

Inspect the wp_options and plugin-specific tables for HTML or JavaScript content within fields that should contain plain text
Review web server access logs for POST requests to plugin admin endpoints originating from external Referer headers
Use a web application firewall (WAF) to flag administrative POST requests lacking valid nonce parameters

Monitoring Recommendations

Enable WordPress activity logging to capture plugin setting modifications with timestamps and user attribution
Monitor browser-reported Content Security Policy (CSP) violations indicating unauthorized inline script execution
Alert on file integrity changes to plugin directories and on new entries in autoloaded options containing script tags

How to Mitigate CVE-2025-31385

Immediate Actions Required

Deactivate and remove the Site Table of Contents plugin until a patched release is published
Audit the WordPress database for stored XSS payloads injected through the plugin and remove malicious entries
Force a password reset for all administrator accounts and invalidate active sessions

Patch Information

At the time of publication, no patched version has been identified for Site Table of Contents. The vulnerability affects all versions through 0.3. Monitor the Patchstack advisory and the WordPress plugin repository for an updated release.

Workarounds

Replace the plugin with an actively maintained table-of-contents alternative that implements nonce verification and output escaping
Deploy a WAF rule that blocks POST requests to the plugin's admin endpoints when the Referer header is missing or external
Apply a strict Content Security Policy that disallows inline scripts to limit the impact of any injected payload
Train administrators to avoid clicking external links while authenticated to the WordPress admin panel

bash

# Example WAF rule (ModSecurity) blocking cross-origin POSTs to the plugin
SecRule REQUEST_METHOD "@streq POST" \
  "id:1003185,phase:1,deny,status:403,\
   chain,msg:'Block cross-origin POST to site-table-of-contents'"
  SecRule REQUEST_URI "@contains /wp-admin/" \
    "chain"
    SecRule REQUEST_HEADERS:Referer "!@beginsWith https://your-site.example/" \
      "t:none"