VulnTitan VulnTitan Security command center
Plugin Vulnerability Hub
Plugin 5 known issues Latest disclosed Oct 15, 2024

Table of Contents Plus Vulnerabilities

Review known vulnerability records for the WordPress plugin Table of Contents Plus (`table-of-contents-plus`), including severity, CVE references, affected versions, and patch status.

Recent tracked CVEs on this page include CVE-2024-5578, CVE-2024-49250 and CVE-2023-44473, so operators can jump from disclosure to patch validation without scanning the full feed first.

View on WordPress.org Back to Feed
Known Records
5
High or Critical
0
Patch Coverage
100%
Last Updated
Feb 28, 2025
Priority CVE Quick Links

Fast paths into Table of Contents Plus CVE reports

Start with the highest-signal CVE records for this WordPress plugin before scanning the full vulnerability feed.

Indexed CVEs
4
CVE-2024-5578 Medium 2411.1
CVE-2024-5578 Table of Contents Plus Stored Cross-Site Scripting

Table of Contents Plus <= 2411 - Authenticated (Editor+) Stored Cross-Site Scripting

CVE-2022-4479 Medium 2212
CVE-2022-4479 Table of Contents Plus Stored Cross-Site Scripting

Table of Contents Plus <= 2106 - Authenticated (Administrator+) Stored Cross-Site Scripting

CVE-2024-49250 Medium 2411
CVE-2024-49250 Table of Contents Plus Cross-Site Request Forgery

Table of Contents Plus <= 2408 - Cross-Site Request Forgery

CVE-2023-44473 Medium 2309
CVE-2023-44473 Table of Contents Plus Cross-Site Request Forgery

Table of Contents Plus <= 2302 - Cross-Site Request Forgery

Coverage Snapshot

What this page helps you verify fast

This hub clusters every indexed record for Table of Contents Plus so operators can confirm whether a disclosed issue maps to the installed slug, version range, and patch path.

Patch Visibility
5 records include a published patch path, leaving 0 with no listed safe release yet.
Severity Mix
0 critical and 0 high severity findings.
Recent CVEs
CVE-2024-5578, CVE-2024-49250 and CVE-2023-44473
Reference Workflow
Jump from the hub into the full report when you need remediation notes, exploit context, CVSS vectors, or source references.
Triage First

Open the records most likely to drive action

These recent records surface the CVE strings, patch cues, and direct report links most operators need first.

Known Vulnerabilities

Reports for Table of Contents Plus

Sorted by latest disclosure date so newly published issues surface first.

Plugin Medium Patched: Yes CVE-2024-5578
CVE-2024-5578: Table of Contents Plus <= 2411 - Authenticated (Editor+) Stored Cross-Site Scripting

The Table of Contents Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2411 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administ...

Published
Oct 15, 2024
Patched Release
2411.1
Affected Versions
Versions up to 2411
Next Step
Update to 2411.1 or newer if supported.
Open CVE-2024-5578 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-49250
CVE-2024-49250: Table of Contents Plus <= 2408 - Cross-Site Request Forgery

The Table of Contents Plus plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2408. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized...

Published
Oct 14, 2024
Patched Release
2411
Affected Versions
Versions up to 2408
Next Step
Update to 2411 or newer if supported.
Open CVE-2024-49250 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2023-44473
CVE-2023-44473: Table of Contents Plus <= 2302 - Cross-Site Request Forgery

The Table of Contents Plus plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2302. This is due to incorrect nonce validation on the save_admin_options() function. This makes it possible for unauthenticated attackers to modify the p...

Published
Sep 29, 2023
Patched Release
2309
Affected Versions
Versions up to 2302
Next Step
Update to 2309 or newer if supported.
Open CVE-2023-44473 Report Open CVE Reference
Plugin Medium Patched: Yes
Table of Contents Plus <= 2302 - Authenticated (Administrator+) Stored Cross-Site Scripting

The Table of Contents Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 2302 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrato...

Published
Sep 19, 2023
Patched Release
2309
Affected Versions
Versions before 2309
Next Step
Update to 2309 or newer if supported.
Open Full Report
Plugin Medium Patched: Yes CVE-2022-4479
CVE-2022-4479: Table of Contents Plus <= 2106 - Authenticated (Administrator+) Stored Cross-Site Scripting

The Table of Contents Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' and 'label' properties in the [toc] and [sitemap_pages] shortcodes respectively in versions up to, and including, 2106 due to insufficient input sanitization and output es...

Published
Dec 16, 2022
Patched Release
2212
Affected Versions
Versions up to 2106
Next Step
Update to 2212 or newer if supported.
Open CVE-2022-4479 Report Open CVE Reference