PT-2024-36585 · WordPress · Table Of Contents Plus

Dmitry Ignatyev · Published 2024-11-04 · Updated 2024-11-06 · CVE-2024-5578

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Table of Contents Plus WordPress plugin versions through 2408

Description The Table of Contents Plus WordPress plugin does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered html is disallowed. This issue could enable malicious script injection.

Recommendations For Table of Contents Plus WordPress plugin versions through 2408, update the plugin to a patched version as soon as possible to mitigate the risk of Cross-Site Scripting attacks.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-5578

Affected Products

Table Of Contents Plus

References · 7

• 🔥 https://wpscan.com/vulnerability/641e4fc3-4214-4c2e-8245-15e9dcdd37b4 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-5578 · Security Note
• https://osv.dev/vulnerability/CVE-2024-5578 · Vendor Advisory
• https://t.me/cvenotify/100620 · Telegram Post
• https://twitter.com/oktsec/status/1853703190274875728 · Twitter Post
• https://twitter.com/CVEnew/status/1853684219488444739 · Twitter Post
• https://t.me/cvedetector/9819 · Telegram Post