Theluckywp develops a WordPress table-of-contents plugin that, despite modest disclosure volume, operates within a widely installed ecosystem where plugin vulnerabilities can affect numerous sites. The vendor's vulnerability profile concentrates in application-layer input-handling issues, specifically cross-site scripting and cross-site request forgery flaws that are characteristic of web-facing WordPress components. Current vulnerability counts, severity distribution, and exploitation activity are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Theluckywp over time
Signals from CVEs in this vendor scope (6 CVEs).
6 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2024-2119MEDIUM The LuckyWP Table of Contents plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the attrs parameter in all versions up to, and including, 2.1.5 due to insuff | May 22, 2024 | 6.1 | 19 | NO | NO |
CVE-2025-2299MEDIUM The LuckyWP Table of Contents plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.10. This is due to missing or incorrect non | Apr 3, 2025 | 6.1 | 18 | NO | NO |
CVE-2024-9641MEDIUM The LuckyWP Table of Contents WordPress plugin before 2.1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Store | Dec 12, 2024 | 4.8 | 16 | NO | NO |
CVE-2023-6487MEDIUM The LuckyWP Table of Contents plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Header Title' field in all versions up to and including 2.1.4 due to insuff | May 22, 2024 | 5.4 | 16 | NO | NO |
CVE-2024-2218MEDIUM The LuckyWP Table of Contents WordPress plugin through 2.1.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stor | Jun 14, 2024 | 4.6 | 15 | NO | NO |
CVE-2024-2953MEDIUM The LuckyWP Table of Contents plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 2.1.4 due to insufficient | May 22, 2024 | 4.8 | 14 | NO | NO |
Signals from CVEs in this vendor scope (6 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Theluckywp.
Media articles that mention a CVE ID that affects a product developed by Theluckywp — matched by CVE ID, not by vendor name.