{"id":"CVE-2024-6334","aliases":["EUVD-2024-47980","GHSA-f4jx-rpw7-5p2c"],"status":"published","title":"Easy Table of Contents \u003c 2.0.67 - Editor+ Stored XSS","description":"The Easy Table of Contents WordPress plugin before 2.0.67.1 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00393,"percentile":0.33777,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2024-07-09T06:00:05Z","modified":"2026-06-17T08:17:48Z","products":[{"vendor":"magazine3","product":"easy table of contents"},{"vendor":"magazine3","product":"easy_table_of_contents"},{"vendor":"unknown","product":"easy table of contents"}],"references":[{"url":"https://wpscan.com/vulnerability/6c09083c-6960-4369-8c5c-ad20e34aaa8b/","tags":["exploit","vdb-entry","technical-description","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-6334"},{"url":"https://wpscan.com/vulnerability/6c09083c-6960-4369-8c5c-ad20e34aaa8b"},{"url":"https://github.com/advisories/GHSA-f4jx-rpw7-5p2c"}],"sources":{"cve":[{"id":"CVE-2024-6334","title":" Easy Table of Contents \u003c 2.0.67 - Editor+ Stored XSS","description":"The Easy Table of Contents WordPress plugin before 2.0.67.1 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.","status":"published","published":"2024-07-09T06:00:05.147Z","modified":"2024-11-21T14:57:54.683Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:34:11.305983Z"}],"euvd":[{"id":"EUVD-2024-47980","description":"The Easy Table of Contents WordPress plugin before 2.0.67.1 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.","status":"published","published":"2024-07-09T06:00:05Z","modified":"2024-11-21T14:57:54Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T00:04:52.909214Z"}],"ghsa":[{"id":"GHSA-f4jx-rpw7-5p2c","title":"The Easy Table of Contents WordPress plugin before 2.0.67.1 does not sanitise and escape some of...","description":"The Easy Table of Contents WordPress plugin before 2.0.67.1 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.","status":"published","published":"2024-07-09T06:30:41Z","modified":"2025-05-21T21:31:12Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:02:23.604118Z"}],"nvd":[{"id":"CVE-2024-6334","description":"The Easy Table of Contents WordPress plugin before 2.0.67.1 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.","status":"published","published":"2024-07-09T06:15:03.383Z","modified":"2026-06-17T08:17:48.113Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:10:10.545705Z"}]}}