{"id":"CVE-2024-7082","aliases":["EUVD-2024-48074","GHSA-fhmm-33rx-rqfp"],"status":"published","title":"easy-table-of-contents \u003c 2.0.68 - Editor+ Stored XSS","description":"The Easy Table of Contents WordPress plugin before 2.0.68 does not sanitise and escape some parameters, which could allow users with a role as low as Editor to perform Cross-Site Scripting attacks.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00407,"percentile":0.3527,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2024-08-06T06:00:07Z","modified":"2026-06-17T08:19:19Z","products":[{"vendor":"magazine3","product":"easy table of contents"},{"vendor":"magazine3","product":"easy_table_of_contents"},{"vendor":"unknown","product":"easy table of contents"}],"references":[{"url":"https://wpscan.com/vulnerability/8f30e685-00fa-4dbb-b516-2d14e4b13697/","tags":["exploit","vdb-entry","technical-description","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-7082"},{"url":"https://wpscan.com/vulnerability/8f30e685-00fa-4dbb-b516-2d14e4b13697"},{"url":"https://github.com/advisories/GHSA-fhmm-33rx-rqfp"}],"sources":{"cve":[{"id":"CVE-2024-7082","title":"easy-table-of-contents \u003c 2.0.68 - Editor+ Stored XSS","description":"The Easy Table of Contents WordPress plugin before 2.0.68 does not sanitise and escape some parameters, which could allow users with a role as low as Editor to perform Cross-Site Scripting attacks.","status":"published","published":"2024-08-06T06:00:07.251Z","modified":"2024-10-27T16:18:02.374Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:34:21.025267Z"}],"euvd":[{"id":"EUVD-2024-48074","description":"The Easy Table of Contents WordPress plugin before 2.0.68 does not sanitise and escape some parameters, which could allow users with a role as low as Editor to perform Cross-Site Scripting attacks.","status":"published","published":"2024-08-06T06:00:07Z","modified":"2024-10-27T16:18:02Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T00:05:17.135828Z"}],"ghsa":[{"id":"GHSA-fhmm-33rx-rqfp","title":"The Easy Table of Contents WordPress plugin before 2.0.68 does not sanitise and escape some...","description":"The Easy Table of Contents WordPress plugin before 2.0.68 does not sanitise and escape some parameters, which could allow users with a role as low as Editor to perform Cross-Site Scripting attacks.","status":"published","published":"2024-08-06T06:30:38Z","modified":"2024-10-27T18:31:46Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:58:37.010857Z"}],"nvd":[{"id":"CVE-2024-7082","description":"The Easy Table of Contents WordPress plugin before 2.0.68 does not sanitise and escape some parameters, which could allow users with a role as low as Editor to perform Cross-Site Scripting attacks.","status":"published","published":"2024-08-06T06:15:36.42Z","modified":"2026-06-17T08:19:19.77Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:10:17.832118Z"}]}}