¿Es seguro Table Of Contents Plus?

Qué hace este plugin

• Slug: table-of-contents-plus
• 200000+ instalaciones activas

cmsindexessitemaptable of contentstoc

Estado de mantenimiento

• Última versión conocida: 2411.1
• PHP máximo soportado (analizado): 8.4

Vulnerabilidades conocidas

4 CVEs conocidos registrados para Table Of Contents Plus. Reportadas entre 2022 y 2024.

CVE-2024-5578

The Table of Contents Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2411 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2024-49250

The Table of Contents Plus plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2408. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2023-44473

Update the WordPress Table of Contents Plus plugin to the latest available version (at least 2309). Muhammad Daffa discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress Table of Contents Plus Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. This vulnerability has been fixed in version 2309.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Table of Contents Plus [table-of-contents-plus] < 2309 (closed)

Update the WordPress Table of Contents Plus plugin to the latest available version (at least 2309). Unknown discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Table of Contents Plus Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 2309.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Table of Contents Plus [table-of-contents-plus] < 2309 (closed)

The Table of Contents Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 2302 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2022-4479

The Table of Contents Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' and 'label' properties in the [toc] and [sitemap_pages] shortcodes respectively in versions up to, and including, 2106 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Table of Contents Plus [table-of-contents-plus] < 2309 (closed)

The Table of Contents Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 2302 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

Cómo solucionarlo

Mantén Table Of Contents Plus actualizado — 2411.1 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").

Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.

Alternativas más seguras / más establecidas

• White Label CMS — 200000+ instalaciones activas — 94/100 (113) — PHP máx. 8.4
• List category posts — 80000+ instalaciones activas — 94/100 (254) — PHP máx. 8.4
• Cornerstone — 30000+ instalaciones activas — 80/100 (6) — PHP máx. <8.0
• Rich Table of Contents — 20000+ instalaciones activas — 82/100 (17) — PHP máx. <8.0
• Simple Post Type Permalinks — 9000+ instalaciones activas — 100/100 (10)