Read the docs

theluckywp

Records6All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9

Exploited now

theluckywp records in CISA KEV

No theluckywp vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Luckywp Table Of Contents 6 records MEDIUM

Records

6 records

TI-2024-08944 CVE-2024-9641 · GHSA-vqvq-ggf5-9h68

LuckyWP Table of Contents < 2.1.7 - Admin+ Stored XSS

Priority MEDIUM 55

The LuckyWP Table of Contents WordPress plugin before 2.1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00367 Published 2024-12-12 Fixed in 2.1.7 CWE-79
TI-2024-02060 CVE-2024-2218 · GHSA-rgw4-v387-9jvw

LuckyWP Table of Contents <= 2.1.4 - Admin+ Stored XSS

Priority MEDIUM 54

The LuckyWP Table of Contents WordPress plugin through 2.1.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even whe…

CVSS 3.1MEDIUM 4.6 Network Low privileges User interaction EPSS 0.00342 Published 2024-06-14 No fix listed CWE-79
TI-2024-01969 CVE-2024-2119 · GHSA-pg78-5grf-jf97

LuckyWP Table of Contents <= 2.1.5 - Reflected Cross-Site Scripting

Priority LOW 27

The LuckyWP Table of Contents plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the attrs parameter in all versions up to, and including, 2.1.5 due to insufficient input sanitization and output esc…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0038 Published 2024-05-22 No fix listed CWE-79
TI-2024-02761 CVE-2024-2953 · GHSA-r5hc-q3m9-jg75

LuckyWP Table of Contents <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

Priority LOW 25

The LuckyWP Table of Contents plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 2.1.4 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.00328 Published 2024-05-22 No fix listed CWE-79
TI-2023-05945 CVE-2023-6487 · GHSA-m4gm-7759-99c8

LuckyWP Table of Contents <= 2.1.5 - Authenticated (Administrator+) Cross-Site Scripting

Priority LOW 24

The LuckyWP Table of Contents plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Header Title' field in all versions up to and including 2.1.4 due to insufficient input sanitization and output esc…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00298 Published 2024-05-22 No fix listed CWE-79
Open these records in search →