The Joli Table Of Contents WordPress plugin contains a stored cross‑site scripting flaw that occurs when certain configuration values are rendered in an administrative page without proper escaping or sanitisation. Because the values are persisted and displayed to users who have administrative or higher privileges, an attacker who can access an administrator account can inject arbitrary HTML or JavaScript. The resulting client‑side code can execute in the context of the logged‑in administrator, allowing session hijacking, credential theft, defacement, or further attacks within the trusted environment. This vulnerability is classified as CWE‑79.

The vulnerability affects all WordPress sites that have installed the Joli Table Of Contents plugin with a version earlier than 2.8.1, specifically the 2.0.0 through 2.8.0 releases. The plugin is developed by the vendor 'Unknown', and the flaw resides in the admin UI that displays plugin settings. Systems running WordPress on single‑site or multisite installations, especially those that allow non‑trusted administrators, are at risk until the plugin is updated to a fixed release.

The flaw is only exploitable by users with administrative or higher privileges; it does not provide arbitrary code execution on the server. A CVSS score of 3.5 indicates low severity, and an EPSS score of < 1% suggests a very low likelihood of exploitation. The KEV catalog does not list this vulnerability, indicating no known widespread exploitation yet. Nonetheless, the potential for attackers to perform session hijacking or defacement within the privileged administrative context warrants prompt remediation. In multisite or shared environments, a compromised administrator could spread malicious payloads across multiple subsites, amplifying the risk.