plugin
12 known security issues reported for the Table Of Contents Plus WordPress plugin. Most recent disclosed Nov 5, 2024.
Running Table Of Contents Plus on your site? Check whether your installed version is affected.
Scan your site free[en] The Table of Contents Plus WordPress plugin through 2408 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
[en] Cross-Site Request Forgery (CSRF) vulnerability in Michael Tran Table of Contents Plus allows Cross Site Request Forgery.This issue affects Table of Contents Plus: from n/a through 2408.
The Table of Contents Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2411 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to in...
The Table of Contents Plus plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2408. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged request granted they...
[en] Cross-Site Request Forgery (CSRF) vulnerability in Michael Tran Table of Contents Plus plugin <= 2302 versions.
The Table of Contents Plus plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2302. This is due to incorrect nonce validation on the save_admin_options() function. This makes it possible for unauthenticated attackers to modify the plugin's settings via a forged request gr...
Update the WordPress Table of Contents Plus plugin to the latest available version (at least 2309). Unknown discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Table of Contents Plus Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements,...
The Table of Contents Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 2302 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject...
The Table of Contents Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 2302 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject...
[en] The Table of Contents Plus WordPress plugin before 2212 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users su...
The Table of Contents Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' and 'label' properties in the [toc] and [sitemap_pages] shortcodes respectively in versions up to, and including, 2106 due to insufficient input sanitization and output escaping. This makes it possible for authe...
The Table of Contents Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 2302 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject...
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free