The Easy Table of Contents WordPress plugin is vulnerable because it fails to sanitize and escape user‑supplied attributes used in its ez‑toc shortcode. A contributor or higher can embed arbitrary JavaScript or HTML into a page that contains the shortcode. When any visitor opens that page, the injected code executes in the victim’s browser, potentially stealing session cookies, defacing the site, or redirecting to malicious sites.

All WordPress sites running Easy Table of Contents version 2.0.78 or earlier are impacted, provided that contributors or higher users have permission to insert the ez‑toc shortcode. Sites using newer versions are not affected.

The CVSS score of 6.4 indicates moderate severity, while the EPSS score of < 1% suggests that exploitation is unlikely in the wild. The vulnerability is not listed in CISA’s KEV catalog. Attackers must first obtain authenticated contributor or higher access to craft the malicious payload, then rely on a visitor to view the injected page for the script to run. The effect is confined to the victim’s browsing session but can be severe if the attacker steals credentials or performs further malicious actions from that session.