Cross-site Scripting Vulnerability in WordPress Tooltips by Tomas

CVE-2025-63005

What is CVE-2025-63005?

The vulnerability in the WordPress Tooltips plugin developed by Tomas allows for stored cross-site scripting (XSS), enabling malicious users to inject harmful scripts into web pages. This flaw affects versions of the plugin from n/a through 10.7.9, posing a risk to any site that utilizes it. When an affected site serves pages containing the tainted tooltips, the injected scripts can execute in the browsers of visitors, potentially compromising user data and site integrity. Website administrators are urged to take immediate action to mitigate the threat.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References