{"id":"CVE-2024-5030","aliases":["EUVD-2024-46297","GHSA-v664-p69f-2qfg"],"status":"published","title":"CM Table Of Contents – WordPress TOC Plugin \u003c 1.2.3 - Settings Reset via CSRF","description":"The CM Table Of Contents  WordPress plugin before 1.2.3 does not have CSRF check in place when resetting its settings, which could allow attackers to make a logged in admin perform such action via a CSRF attack","severity":{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00199,"percentile":0.0981,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-352"],"published":"2024-11-18T06:00:01Z","modified":"2026-06-17T08:14:56Z","products":[{"vendor":"cminds","product":"cm_table_of_contents"},{"vendor":"creativemindssolutions","product":"cm-table-of-content"},{"vendor":"unknown","product":"cm table of contents"}],"references":[{"url":"https://wpscan.com/vulnerability/2c2e994c-31bd-4de4-9480-b86f980d4130/","tags":["exploit","vdb-entry","technical-description","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-5030"},{"url":"https://wpscan.com/vulnerability/2c2e994c-31bd-4de4-9480-b86f980d4130"},{"url":"https://github.com/advisories/GHSA-v664-p69f-2qfg"}],"sources":{"cve":[{"id":"CVE-2024-5030","title":"CM Table Of Contents – WordPress TOC Plugin \u003c 1.2.3 - Settings Reset via CSRF","description":"The CM Table Of Contents  WordPress plugin before 1.2.3 does not have CSRF check in place when resetting its settings, which could allow attackers to make a logged in admin perform such action via a CSRF attack","status":"published","published":"2024-11-18T06:00:01.043Z","modified":"2024-11-18T13:57:03.418Z","cvss":[{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low","assessor":"adp"}],"updated_at":"2026-11-02T14:34:01.286506Z"}],"euvd":[{"id":"EUVD-2024-46297","description":"The CM Table Of Contents  WordPress plugin before 1.2.3 does not have CSRF check in place when resetting its settings, which could allow attackers to make a logged in admin perform such action via a CSRF attack","status":"published","published":"2024-11-18T06:00:01Z","modified":"2024-11-18T13:57:03Z","cvss":[{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-03T00:04:57.661321Z"}],"ghsa":[{"id":"GHSA-v664-p69f-2qfg","title":"The CM Table Of Contents  WordPress plugin before 1.2.3 does not have CSRF check in place when...","description":"The CM Table Of Contents  WordPress plugin before 1.2.3 does not have CSRF check in place when resetting its settings, which could allow attackers to make a logged in admin perform such action via a CSRF attack","status":"published","published":"2024-11-18T06:30:36Z","modified":"2025-05-15T18:32:46Z","cvss":[{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:02:18.914991Z"}],"nvd":[{"id":"CVE-2024-5030","description":"The CM Table Of Contents  WordPress plugin before 1.2.3 does not have CSRF check in place when resetting its settings, which could allow attackers to make a logged in admin perform such action via a CSRF attack","status":"published","published":"2024-11-18T06:15:06.593Z","modified":"2026-06-17T08:14:56.403Z","cvss":[{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:10:37.632431Z"}]}}