Cross Site Scripting Vulnerability in Tooltipy Plugin for WordPress
CVE-2018-1000512

6.1MEDIUM

Key Information:

Vendor

WordPress
Status
Tooltipy
Vendor
CVE Published:
26 June 2018

What is CVE-2018-1000512?

The Tooltipy plugin for WordPress, specifically version 5, contains a Cross Site Scripting (XSS) vulnerability found in the Glossary shortcode. This flaw can be exploited by attackers, enabling unauthorized actions within the admin's privileges. An attacker needs to trick an administrator into clicking a malicious link to execute the exploit. It is important to upgrade to version 5.1 or later to mitigate this security risk.

References

https://advisories.dxw.com/advisories/xss-in-tooltipy/
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.