CVE-2026-66645: Table Of Contents Block XSS Vulnerability

CVE-2026-66645 Overview

CVE-2026-66645 is a stored Cross-Site Scripting (XSS) vulnerability affecting the WordPress Table Of Contents Block plugin in versions 1.5.0 and earlier. The flaw allows authenticated users with Contributor-level privileges to inject malicious JavaScript into block content. When another user views the affected page, the injected script executes in their browser session. The vulnerability is tracked under [CWE-79] (Improper Neutralization of Input During Web Page Generation). Patchstack published the advisory documenting this issue.

Critical Impact
A Contributor-level attacker can inject persistent JavaScript that executes in the browsers of higher-privileged users, enabling session theft, forced administrative actions, or redirection to attacker-controlled infrastructure.

Affected Products

WordPress Table Of Contents Block plugin
Versions 1.5.0 and earlier
WordPress sites permitting Contributor-role accounts

Discovery Timeline

2026-08-18 - CVE-2026-66645 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-66645

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the Table Of Contents Block plugin for WordPress. Users with Contributor privileges can submit block content that is not properly sanitized before rendering. The plugin fails to neutralize HTML and script content supplied through block attributes or inner content fields. When editors or administrators preview or publish the submitted content, the payload executes with their browser context. The scope change indicated in the CVSS vector reflects that an attacker with limited privileges can impact users in a different security scope.

Exploitation requires an existing Contributor account and user interaction to trigger the payload. Successful exploitation grants the attacker script execution against higher-privileged accounts, which can be leveraged to escalate privileges within the WordPress installation.

Root Cause

The root cause is improper neutralization of user-controlled input passed through the Table Of Contents Block. The plugin does not enforce sufficient output encoding or input sanitization on block attributes accessible to Contributor-role users. WordPress typically restricts unfiltered HTML to Editor and Administrator roles, but the plugin's rendering path bypasses these controls for specific block fields.

Attack Vector

An attacker authenticates as a Contributor and creates or edits a post containing a Table Of Contents block. The attacker embeds JavaScript within block attributes that accept string input. The post is then submitted for review. When an Editor or Administrator opens the post to review or publish it, the injected script executes in their session. See the Patchstack XSS Vulnerability Report for advisory details. No verified proof-of-concept code is publicly available at the time of publication.

Detection Methods for CVE-2026-66645

Indicators of Compromise

Unexpected <script> tags, event handlers, or javascript: URIs stored within wp_posts content for entries using the Table Of Contents block.
New administrative user accounts or elevated capabilities created shortly after a Contributor submitted a post for review.
Outbound HTTP requests from administrator browser sessions to unfamiliar domains immediately after opening a pending post.

Detection Strategies

Audit posts authored by Contributor accounts for embedded HTML tags, encoded script payloads, or suspicious block attribute values.
Query the wp_posts table for post_content entries referencing the Table Of Contents block and containing script-related tokens.
Review web server access logs for unusual patterns following post-preview or post-publish requests by privileged users.

Monitoring Recommendations

Enable WordPress activity logging to capture post creation, revision, and role-change events with timestamps and actor identities.
Monitor for the installation of the Table Of Contents Block plugin and confirm that all deployed instances are patched.
Alert on administrative account changes, plugin installations, and option modifications that occur inside admin sessions viewing Contributor content.

How to Mitigate CVE-2026-66645

Immediate Actions Required

Update the Table Of Contents Block plugin to a version later than 1.5.0 that contains the vendor patch.
Restrict Contributor-role assignments to trusted accounts and audit existing Contributor users.
Review pending and draft posts for injected scripts before Editors or Administrators open them for review.

Patch Information

Refer to the Patchstack XSS Vulnerability Report for the current patched version and vendor guidance. Apply updates through the WordPress plugin management interface or via WP-CLI once the fixed release is available.

Workarounds

Temporarily deactivate the Table Of Contents Block plugin until the patched version is deployed.
Deploy a Web Application Firewall (WAF) rule that blocks script tags and event handlers in block attribute payloads submitted by Contributor accounts.
Enforce a strict Content Security Policy (CSP) that disallows inline script execution within the WordPress admin interface.

bash

# Update the plugin using WP-CLI once a patched version is published
wp plugin update table-of-contents-block

# Verify the installed version
wp plugin get table-of-contents-block --field=version

# If a patched release is not yet available, deactivate the plugin
wp plugin deactivate table-of-contents-block