CVE-2025-15694

LowCVSS 3.5/10Last modified Oct 19, 2026

Description

The Joli Table Of Contents WordPress plugin before 2.8.1 does not sanitise and escape some of its settings before outputting them in an admin page, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed, for example in a multisite setup.

Metrics

CVSS 3.1 3.5/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	Joli Table Of Contents	>= 2.0.0, < 2.8.1

References

https://wpscan.com/vulnerability/9ebaf1aa-eb8b-4c62-bbd0-07918503fbf1/

Timeline

Published: Sep 5, 2026
Last modified: Oct 19, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-156953.5The Translate WordPress with GTranslate WordPress plugin before 3.0.10 does not validate one of its settings before the bundled front-end sc CVE-2025-156966.8The Real3D Flipbook WordPress plugin before 5.4 does not sanitize or escape several flipbook editor fields before rendering them back in th CVE-2025-156977.1The Dictionary WordPress plugin through 1.0 does not escape user input before reflecting it back in the responses of several directly access CVE-2025-156983.5The Business Name Generator WordPress plugin through 1.3 does not sanitise and escape some of its settings, which could allow high privilege CVE-2025-15709.8The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to privilege escalatio CVE-2025-157008.8The AWP Classifieds WordPress plugin before 4.4.9 does not validate the type of files extracted from an uploaded ZIP archive during its list CVE-2025-157013.5The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise and escape some of its settings before outputting them on front-end pa CVE-2025-157028.8The Cloud Blocks WordPress plugin through 1.1.8 does not perform any authorisation or sanitisation when storing block asset URLs, allowing u CVE-2025-157033.5The HireZoot WordPress plugin before 4.0.0 does not sanitise and escape one of its job specification settings before it is reflected back i CVE-2025-157053.5The Contact Form by Supsystic WordPress plugin before 1.8.0 does not sanitise and escape a form name, allowing users with access to the for CVE-2025-157083.5The Live Composer WordPress plugin before 2.1.23 does not sanitise and escape some of its custom post type slug settings before using them CVE-2025-15715.4The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Animated Text and Imag