CVE-2026-84931: Joli Table Of Contents WordPress XSS Flaw

CVE-2026-84931 Overview

CVE-2026-84931 is a stored Cross-Site Scripting (XSS) vulnerability in the Joli Table Of Contents WordPress plugin versions before 3.0.3. The plugin fails to sanitize or escape a shortcode attribute value before rendering it inside an HTML element's attribute. Authenticated users with the Author role or higher can inject arbitrary HTML attributes and JavaScript. The injected payload executes in the browser of anyone viewing the post, including administrators. The flaw crosses a privilege boundary on multisite installations, where Author-level users are explicitly denied unfiltered_html capability.

Critical Impact
Author-level accounts can execute arbitrary JavaScript in administrator browsers, enabling session hijacking, account takeover, and multisite privilege escalation.

Affected Products

Joli Table Of Contents WordPress plugin versions prior to 3.0.3
WordPress single-site installations with the plugin enabled
WordPress multisite installations where the plugin is network-active

Discovery Timeline

2026-09-05 - CVE-2026-84931 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-84931

Vulnerability Analysis

The Joli Table Of Contents plugin processes user-supplied shortcode attributes and injects them into rendered HTML markup. The plugin does not apply esc_attr() or equivalent escaping when the attribute value is placed inside an HTML element's attribute context. An authenticated user with post-editing privileges can craft a shortcode whose attribute value breaks out of the surrounding quotes and introduces new attributes such as onmouseover or onclick. The injected JavaScript executes in the browser session of any user who renders the affected post. This vulnerability is classified under [CWE-79] Improper Neutralization of Input During Web Page Generation.

Root Cause

The root cause is missing output encoding in the shortcode handler. The plugin trusts shortcode attribute input from the post editor and concatenates it directly into an HTML attribute context. WordPress core requires Authors on multisite to be denied raw HTML posting through the unfiltered_html capability check. This plugin bypasses that boundary by producing unescaped output on the front end regardless of the author's capabilities.

Attack Vector

An attacker with Author, Editor, or Contributor-with-publish rights authenticates to the WordPress admin. The attacker creates or edits a post containing the vulnerable shortcode with a malicious attribute payload designed to break out of the target attribute and register a JavaScript event handler. When an administrator or subscriber later loads the published post, the browser parses the injected attribute and executes the attacker's script under the origin of the WordPress site. Payloads commonly target the administrator session cookie, create a new administrator account via the REST API, or install a backdoor plugin.

The vulnerability manifests in the shortcode attribute rendering path. See the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-84931

Indicators of Compromise

Post content or wp_posts.post_content rows containing Joli Table Of Contents shortcodes with attribute values that include quote characters, on*= event handlers, or javascript: URIs.
Unexpected administrator account creation shortly after an admin viewed a post authored by a lower-privileged user.
Outbound HTTP requests from administrator browsers to attacker-controlled domains referenced in stored post content.
New plugin installations, theme edits, or wp_options changes correlated with an administrator's page view of a post.

Detection Strategies

Query the WordPress database for posts containing the plugin's shortcode and inspect attribute values for HTML-breaking characters.
Review web server access logs for POST requests to /wp-admin/post.php from Author-level accounts followed by GET requests from administrator sessions.
Deploy a Web Application Firewall rule that flags shortcode attributes containing ", >, or on[a-z]+= patterns.
Compare the installed plugin version against 3.0.3 across all sites in a multisite network.

Monitoring Recommendations

Monitor for creation of administrator role users through the REST API or wp-admin/user-new.php outside of change windows.
Log and alert on modifications to active_plugins, siteurl, and home options that follow admin page views of user-generated content.
Track anomalous JavaScript execution and DOM-based script injection through browser telemetry and endpoint detection.

How to Mitigate CVE-2026-84931

Immediate Actions Required

Upgrade the Joli Table Of Contents plugin to version 3.0.3 or later on every site, including all sites in a multisite network.
Audit wp_users and wp_usermeta for unauthorized administrator accounts and revoke any that were not created through approved processes.
Rotate administrator passwords and invalidate active sessions using wp_destroy_all_sessions() or equivalent.
Review existing posts authored by non-administrator accounts for embedded shortcodes containing suspicious attribute values.

Patch Information

The vendor addressed the issue in Joli Table Of Contents version 3.0.3 by escaping the shortcode attribute value before it is written into the HTML attribute context. Refer to the WPScan Vulnerability Report for the disclosure record and remediation confirmation.

Workarounds

Deactivate the Joli Table Of Contents plugin until the update is applied.
Restrict Author and Contributor role assignments to trusted users only, and demote unused accounts to Subscriber.
Configure a WAF rule to strip or block requests that place special HTML characters inside the plugin's shortcode attributes.
Enforce two-factor authentication for all Author-and-above accounts to reduce the risk of a compromised low-privilege account being weaponized.

bash

# Configuration example: identify vulnerable installations via WP-CLI
wp plugin list --network --format=csv | grep 'joli-table-of-contents'
wp plugin update joli-table-of-contents --version=3.0.3
wp user list --role=author --field=user_login