CVE-2022-4479: Table of Contents Plus < 2212 - Contributor+ Stored XSS
Vulnerability summary
CVE-2022-4479 is a medium (CVSS 5.5) Cross-site Scripting vulnerability in dublue table_of_contents_plus. EPSS estimates a 0.58% chance of exploitation in the next 30 days, higher than 47% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 09-01-2023PublishedVulnerability first disclosed.
- 09-04-2025Last modifiedVulnerability information updated.
Description
The Table of Contents Plus WordPress plugin before 2212 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
CVSS metrics
3 scores · 3 sources · 1 version- CVE.orgCNA5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NDiffers
- NVDNIST5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NDiffers
EPSS trend
Probability
0.58%
Chance of exploitation in the next 30 days
Percentile
47%
Versus all other CVEs
30-day change
Increase +0.01 pp
From 0.57% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (wpscan.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Dublue1 product
- table_of_contents_plus< 2212
Unknown1 product
- table of contents plus< 2212
Wordpress1 product
- table-of-contents-plus≤ 2106 (fixed in 2212)
3 vendors · 3 products
References
2 links- wpscan.com/vulnerability/10f63d30-1b36-459b-80eb-509caaf5d377ExploitVDB EntryTechnical DescriptionThird Party Advisory