The Joli Table Of Contents WordPress plugin before version 3.0.3 does not sanitise or escape a value supplied to a shortcode attribute before outputting it inside an HTML element’s attribute, allowing users with the Author role or higher to embed arbitrary attributes and JavaScript. When other users, even those with elevated privileges, view the post, the injected script runs in their browser, effectively allowing the author to execute code within the context of any viewer’s session.

WordPress sites that have the Joli Table Of Contents plugin installed on any version earlier than 3.0.3, including all single‑site and multisite deployments where the shortcode is enabled.

The vulnerability presents a medium‑risk stored XSS vector requiring only author‑level access and the ability to edit a post containing the shortcode. The CVSS score of 6.8 indicates a moderate severity, and the EPSS score of <1% suggests a low likelihood of exploitation. It is not listed in the CISA KEV catalogue. Attackers can inject malicious code that will execute in the browsers of all users who view the affected post, including administrators.