CVE-2024-7082: 
WordPress vulnerability analysis and mitigation

The Easy Table of Contents WordPress plugin before version 2.0.68 contains a Cross-Site Scripting (XSS) vulnerability. The vulnerability was discovered by Dmitrii Ignatyev and was publicly disclosed on July 16, 2024. The issue affects users with Editor-level privileges or higher who can exploit unsanitized and unescaped parameters in the plugin (WPScan, NVD).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and has received a CVSS v3.1 base score of 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The issue stems from inadequate sanitization and escaping of parameters in the plugin's widget functionality (WPScan).

The vulnerability allows users with Editor privileges to perform Cross-Site Scripting attacks by injecting malicious JavaScript code through the plugin's widget settings. This could potentially lead to the execution of unauthorized scripts in users' browsers when viewing affected pages (WPScan).

The vulnerability has been patched in version 2.0.68 of the Easy Table of Contents plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).