Easy Table of Contents < 2.0.67 – Editor+ Stored XSS | CVE 2024-6334 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.

Proof of Concept

You should create new post with two more heading. Go to the settings of the plugin and change "ez-toc-settings[heading_text_tag]" field to "Malicious JS code".

Affects Plugins

easy-table-of-contents

Fixed in 2.0.67.1

References

CVE

URL

https://research.cleantalk.org/cve-2024-6334/

YouTube Video

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Dmitrii Ignatyev

Submitter

Dmitrii Ignatyev

Submitter website

https://www.linkedin.com/in/dmitriy-ignatyev-8a9189267/

Verified

Yes

WPVDB ID

6c09083c-6960-4369-8c5c-ad20e34aaa8b

Timeline

Publicly Published

2024-06-18 (about 1 year ago)

Added

2024-06-25 (about 1 year ago)

Last Updated

2024-07-16 (about 1 year ago)

Other

Published

Title

Published

2024-02-29

Title

Exclusive Addons for Elementor < 2.6.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2025-04-10

Title

Product Excel Import Export & Bulk Edit for WooCommerce <= 4.7 - Reflected Cross-Site Scripting

Published

2024-05-21

Title

MemberPress < 1.11.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via arglist Parameter

Published

2024-09-26

Title

Themedy Toolbox < 1.0.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes

Published

2025-02-18

Title

Digihood HTML Sitemap <= 3.1.1 - Reflected Cross-Site Scripting via 'channel'