CVE-2025-58614

MediumCVSS 6.5

Published: 03/09/2025(UTC)Updated: 30/09/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

10th percentile - higher than 10% of all known CVEs

Summary

The WordPress plugin Tooltipy up to version 5.5.6 contains a Stored XSS vulnerability due to improper input neutralization during web page generation. An attacker can inject a malicious script that gets stored and executed in the victim's browser.

Risk Assessment

The risk includes session hijacking, data theft, or spreading malicious code within the WordPress admin panel.

Recommendation

Update the Tooltipy plugin to the latest available version that includes a security fix.

Other vulnerabilities in Tooltipy

CVE-2025-62917Medium
The Tooltipy plugin (versions up to 5.5.9) is vulnerable to Stored Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. The vulnerability allows persistent injection of malicious JavaScript that executes in the user's browser.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jamel.Z Tooltipy bluet-keywords-tooltip-generator allows Stored XSS.This issue affects Tooltipy: from n/a through <= 5.5.6.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS