CVE Database /
CVE-2022-4479
CVE · Medium
CVE-2022-4479 — Table of Contents Plus – Automatic Table of Contents for Posts & Pages [table-of-contents-plus] < 2212 (closed)
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2022-4479
|
Table of Contents Plus – Automatic Table of Contents for Posts & Pages [table-of-contents-plus] < 2212 (closed) |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium
5.4
|
< 2212
|
2212 |
2022-12-16 |
—
|
CVE-2022-4479
The Table of Contents Plus plugin for WordPress contains a stored cross-site scripting vulnerability affecting versions 2106 and earlier, where the 'class' parameter in the [toc] shortcode and the 'label' parameter in the [sitemap_pages] shortcode fail to properly sanitize and escape user input. Attackers with administrator privileges can exploit this flaw to inject malicious scripts that execute when other users view the affected pages, though this vulnerability only impacts multisite WordPress installations or those with the unfiltered_html capability disabled.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings