The LuckyWP Table of Contents plugin for WordPress contains a flaw in the ajaxEdit function where nonce validation is missing or incorrect. This results in a Cross‑Site Request Forgery (CWE‑352) that allows an unauthenticated attacker to send forged requests to the plugin. If an administrator is tricked into executing such a request, an attacker can inject arbitrary JavaScript, creating a Reflected Cross‑Site Scripting vulnerability (CWE‑79). The impact is that the injected script runs in the context of the site administrator, potentially leaking credentials or defacing the site.

WordPress sites using the LuckyWP Table of Contents plugin, any version up to and including 2.1.10. The vulnerability affects all installations that route the ajaxEdit endpoint through this plugin without proper nonce verification.

The CVSS score of 6.1 indicates moderate severity. The EPSS score is less than 1 %, showing a low probability of current exploitation, and the vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. Nonetheless, the attack vector relies on social engineering – an attacker must convince an administrator to click a malicious link or otherwise trigger the forged request. While exploitation risk appears moderate, a successful attack would give an attacker JavaScript execution privileges in the admin’s browser context.