CVE-2025-63005
Lifecycle Timeline
2Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tomas WordPress Tooltips wordpress-tooltips allows Stored XSS.This issue affects WordPress Tooltips: from n/a through <= 10.9.3.
Analysis
Stored cross-site scripting (XSS) in Tomas WordPress Tooltips plugin versions 10.9.3 and earlier allows authenticated attackers to inject malicious scripts into tooltip content that execute in the browsers of site administrators and other users. The vulnerability affects WordPress Tooltips through version 10.9.3, and exploitation requires an authenticated user with permissions to create or modify tooltips. No public exploit code or active exploitation has been identified at time of analysis.
Technical Context
The vulnerability is a stored XSS flaw (CWE-79: Improper Neutralization of Input During Web Page Generation) in the WordPress Tooltips plugin, which provides a mechanism for adding interactive tooltip overlays to WordPress sites. The root cause is insufficient input sanitization when tooltip content is stored and later rendered on the frontend. When tooltip data is retrieved from the database and output to the DOM without proper escaping, attacker-controlled JavaScript payloads persist and execute whenever the tooltip is displayed. This affects the plugin's tooltip generation and display functionality across WordPress installations.
Affected Products
Tomas WordPress Tooltips plugin (CPE: wordpress-tooltips) versions up to and including 10.9.3. The plugin is available on the WordPress.org plugin repository and is used across thousands of WordPress installations. Versions prior to the security fix are vulnerable to stored XSS injection.
Remediation
Update the WordPress Tooltips plugin to version 10.9.4 or later, which contains sanitization fixes for tooltip input. Site administrators should immediately apply this patch via the WordPress dashboard Plugins page. As a temporary workaround pending patching, restrict tooltip creation permissions to fully trusted administrator accounts only, and audit existing tooltips for suspicious content via the plugin's tooltip management interface. For detailed advisory information, see https://patchstack.com/database/Wordpress/Plugin/wordpress-tooltips/vulnerability/wordpress-wordpress-tooltips-plugin-10-7-9-cross-site-scripting-xss-vulnerability?_s_id=cve.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today