CVE-2025-62917

MediumCVSS 6.5

Published: 27/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

10th percentile - higher than 10% of all known CVEs

Summary

The Tooltipy plugin (versions up to 5.5.9) is vulnerable to Stored Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. The vulnerability allows persistent injection of malicious JavaScript that executes in the user's browser.

Risk Assessment

An attacker can store a malicious script in the database, which then executes for every user visiting the infected page, potentially leading to session theft, redirections, or content modification. The risk is high as it requires only a one-time injection.

Recommendation

Update the Tooltipy plugin to the latest version (above 5.5.9) or remove it if not used. It is also recommended to perform a security audit of the site to detect any existing infections.

Other vulnerabilities in Tooltipy

CVE-2025-58614Medium
The WordPress plugin Tooltipy up to version 5.5.6 contains a Stored XSS vulnerability due to improper input neutralization during web page generation. An attacker can inject a malicious script that gets stored and executed in the victim's browser.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jamel.Z Tooltipy bluet-keywords-tooltip-generator allows Stored XSS.This issue affects Tooltipy: from n/a through <= 5.5.9.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS