Table of Contents Creator
Table of Contents Creator has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it remains unpatched as of September 2026. Their average CVSS score is 6.1, and the most serious one scores 6.1 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for Table of Contents Creator has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2026.
All of these findings were reported by Skalucy. Table of Contents Creator is installed on roughly 300 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 2.9.2.
CVE-2025-68836Table of Contents Creator <= 1.6.4.1 - Reflected Cross-Site Scripting
Read the full analysisVulnerability Records
Table of Contents Creator
Table of Contents Creator (TOCC) automatically generates a highly customizable dynamic site wide table of contents that is always up-to-date. All entries are navigable making your site very SEO friendly. TOCC can be configured to display static pages, blog entries and forum comments. Another great feature of TOCC is the ability to include anchor tags marked with a special class. This feature allows links to articles, downloads or even other sites to appear within the table of contents as if they are part of your site’s navigation. To generate a table of contents, simply include the <!-- toc-creator --> tag on any page, or use the handy page creation feature located on the plugin admin page. Note that the table of contents is automatically generated every time it is displayed and as such it is always up to date! New comments, pages, blogs and blog categories will automatically appear as soon as they are created. New Features Version 1.6 is now faster, uses less memory, is more robust and above all is extremely flexible. New features may now be added in a future release with minimal risk. Please refer to the change log for further details. The following new features have been added. This release is all about giving more control to your visitors… Hierarchial categories are now supported. Child elements can now be dynamically expanded or collapsed by a vistor. The table of contents can now be dynamically sorted in several different orders by a visitor. All summaries can be dynamically shown or hidden by a visitor. Page help is now available to users by clicking the help icon. Wish List Add option to only show sub pages of the current page within the TOC. This will be handy for using the sidebar widget as a dynamic menu. Add option for maximum number of links per page (split list over multiple pages) – toc pagination. Allow sort by user defined tag. Allow text instead of icons for summary (eg show or hide) if no icon summary selected. Integrate FAQs and preprocessor help with the WordPress Help system (the help pulldown on the settings page).
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C