Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

6 records

Vendor: theluckywp Component: Luckywp Table Of Contents Clear all filters
TI-2024-08944 CVE-2024-9641 · GHSA-vqvq-ggf5-9h68

LuckyWP Table of Contents < 2.1.7 - Admin+ Stored XSS

Priority MEDIUM 55

The LuckyWP Table of Contents WordPress plugin before 2.1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00367 Published 2024-12-12 Fixed in 2.1.7 CWE-79
TI-2024-02060 CVE-2024-2218 · GHSA-rgw4-v387-9jvw

LuckyWP Table of Contents <= 2.1.4 - Admin+ Stored XSS

Priority MEDIUM 54

The LuckyWP Table of Contents WordPress plugin through 2.1.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even whe…

CVSS 3.1MEDIUM 4.6 Network Low privileges User interaction EPSS 0.00342 Published 2024-06-14 No fix listed CWE-79
TI-2024-02761 CVE-2024-2953 · GHSA-r5hc-q3m9-jg75

LuckyWP Table of Contents <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

Priority LOW 25

The LuckyWP Table of Contents plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 2.1.4 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.00328 Published 2024-05-22 No fix listed CWE-79
TI-2023-05945 CVE-2023-6487 · GHSA-m4gm-7759-99c8

LuckyWP Table of Contents <= 2.1.5 - Authenticated (Administrator+) Cross-Site Scripting

Priority LOW 24

The LuckyWP Table of Contents plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Header Title' field in all versions up to and including 2.1.4 due to insufficient input sanitization and output esc…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00298 Published 2024-05-22 No fix listed CWE-79
TI-2024-01969 CVE-2024-2119 · GHSA-pg78-5grf-jf97

LuckyWP Table of Contents <= 2.1.5 - Reflected Cross-Site Scripting

Priority LOW 27

The LuckyWP Table of Contents plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the attrs parameter in all versions up to, and including, 2.1.5 due to insufficient input sanitization and output esc…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0038 Published 2024-05-22 No fix listed CWE-79