{"id":"CVE-2025-15694","title":"The Joli Table Of Contents WordPress plugin before 2.8.1 does not sanitise and escape some of its settings before outputting them in an admin page, which could allow high-privilege users such as administrators to perform Stored Cross-Sit…","summary":"The Joli Table Of Contents WordPress plugin before 2.8.1 does not sanitise and escape some of its settings before outputting them in an admin page, which could allow high-privilege users such as administrators to perform Stored Cross-Sit…","severity":"low","cvss":3.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N","cwe":["CWE-79"],"published":"2026-09-05","updated":"2026-09-08","sourceUpdated":"2026-09-08T19:09:21.310","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-15694","references":[{"url":"https://wpscan.com/vulnerability/9ebaf1aa-eb8b-4c62-bbd0-07918503fbf1/","label":"contact@wpscan.com"}],"tags":["nvd"],"epss":0.00177,"epssPercentile":0.07489,"ingestedAt":"2026-09-06T02:48:40.987Z","slug":"CVE-2025-15694","body":"## Overview\n\nThe Joli Table Of Contents WordPress plugin before 2.8.1 does not sanitise and escape some of its settings before outputting them in an admin page, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed, for example in a multisite setup.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":19,"depthScoreParts":{"impact":19.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":8161,"id":"CVE-2025-15694","ts":1788919965196,"field":"cvss","old":null,"new":"3.5"},{"seq":8160,"id":"CVE-2025-15694","ts":1788919965196,"field":"severity","old":"none","new":"low"},{"seq":7970,"id":"CVE-2025-15694","ts":1788919253257,"field":"cvss","old":"3.5","new":null},{"seq":7969,"id":"CVE-2025-15694","ts":1788919253257,"field":"severity","old":"low","new":"none"},{"seq":7779,"id":"CVE-2025-15694","ts":1788916325830,"field":"cvss","old":null,"new":"3.5"},{"seq":7778,"id":"CVE-2025-15694","ts":1788916325830,"field":"severity","old":"none","new":"low"},{"seq":7588,"id":"CVE-2025-15694","ts":1788915270907,"field":"cvss","old":"3.5","new":null},{"seq":7587,"id":"CVE-2025-15694","ts":1788915270907,"field":"severity","old":"low","new":"none"},{"seq":7397,"id":"CVE-2025-15694","ts":1788912685652,"field":"cvss","old":null,"new":"3.5"},{"seq":7396,"id":"CVE-2025-15694","ts":1788912685652,"field":"severity","old":"none","new":"low"},{"seq":7206,"id":"CVE-2025-15694","ts":1788911303223,"field":"cvss","old":"3.5","new":null},{"seq":7205,"id":"CVE-2025-15694","ts":1788911303223,"field":"severity","old":"low","new":"none"},{"seq":7013,"id":"CVE-2025-15694","ts":1788909054599,"field":"cvss","old":null,"new":"3.5"},{"seq":7012,"id":"CVE-2025-15694","ts":1788909054599,"field":"severity","old":"none","new":"low"},{"seq":6825,"id":"CVE-2025-15694","ts":1788907367530,"field":"cvss","old":"3.5","new":null},{"seq":6824,"id":"CVE-2025-15694","ts":1788907367530,"field":"severity","old":"low","new":"none"},{"seq":6633,"id":"CVE-2025-15694","ts":1788905422034,"field":"cvss","old":null,"new":"3.5"},{"seq":6632,"id":"CVE-2025-15694","ts":1788905422034,"field":"severity","old":"none","new":"low"},{"seq":6451,"id":"CVE-2025-15694","ts":1788903435984,"field":"cvss","old":"3.5","new":null},{"seq":6450,"id":"CVE-2025-15694","ts":1788903435984,"field":"severity","old":"low","new":"none"},{"seq":6247,"id":"CVE-2025-15694","ts":1788901790401,"field":"cvss","old":null,"new":"3.5"},{"seq":6246,"id":"CVE-2025-15694","ts":1788901790401,"field":"severity","old":"none","new":"low"},{"seq":6077,"id":"CVE-2025-15694","ts":1788899548745,"field":"cvss","old":"3.5","new":null},{"seq":6076,"id":"CVE-2025-15694","ts":1788899548745,"field":"severity","old":"low","new":"none"},{"seq":6009,"id":"CVE-2025-15694","ts":1788898240420,"field":"cvss","old":null,"new":"3.5"},{"seq":6008,"id":"CVE-2025-15694","ts":1788898240420,"field":"severity","old":"none","new":"low"}]}