Enhanced Tooltipglossary Vulnerabilities

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Map Locations allows Reflected XSS. This issue affects CM Map Locations: from n/a through 2.0.8.

Affected:

up to 4.3.12

Fixed in:

4.3.12

Disclosed:

Mar 3, 2025

CVE-2025-24758 on NVD →

[en] Multiple plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the cminds_free_guide shortcode in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can...

Affected:

up to 4.3.12

Fixed in:

4.3.12

Disclosed:

Nov 26, 2024

CVE-2024-11202 on NVD →

Multiple plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the cminds_free_guide shortcode in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can succe...

CVSS:

6.1

Affected:

up to 4.3.11

Fixed in:

4.3.12

Disclosed:

Nov 25, 2024

CVE-2024-11202 on NVD →

[en] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Tooltip Glossary allows Stored XSS.This issue affects CM Tooltip Glossary: from n/a through 4.3.9.

Affected:

up to 4.3.11

Fixed in:

4.3.11

Disclosed:

Oct 11, 2024

CVE-2024-48041 on NVD →

The CM Tooltip Glossary plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.3.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pa...

CVSS:

6.4

Affected:

up to 4.3.9

Fixed in:

4.3.11

Disclosed:

Oct 9, 2024

CVE-2024-48041 on NVD →

[en] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Tooltip Glossary allows Stored XSS.This issue affects CM Tooltip Glossary: from n/a through 4.3.7.

Affected:

up to 4.3.9

Fixed in:

4.3.9

Disclosed:

Aug 12, 2024

CVE-2024-43149 on NVD →

The CM Tooltip Glossary plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.3.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pa...

CVSS:

6.4

Affected:

up to 4.3.7

Fixed in:

4.3.9

Disclosed:

Aug 7, 2024

CVE-2024-43149 on NVD →

[en] The CM Tooltip Glossary – Powerful Glossary Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.11. This is due to missing or incorrect nonce validation when saving settings. This makes it possible for unauthenticated attackers to change the plugin's se...

Affected:

up to 4.3.0

Fixed in:

4.3.0

Disclosed:

May 2, 2024

CVE-2024-4086 on NVD →

The CM Tooltip Glossary plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inje...

CVSS:

4.4

Affected:

up to 4.3.3

Fixed in:

4.3.4

Disclosed:

May 1, 2024

CVE-2024-5026 on NVD →

The CM Tooltip Glossary – Powerful Glossary Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.11. This is due to missing or incorrect nonce validation when saving settings. This makes it possible for unauthenticated attackers to change the plugin's setting...

CVSS:

4.3

Affected:

up to 4.2.11

Fixed in:

4.3.0

Disclosed:

Apr 24, 2024

CVE-2024-4086 on NVD →

[en] The CM Tooltip Glossary WordPress plugin before 3.9.21 does not escape some glossary_tooltip shortcode attributes, which could allow users a role as low as Contributor to perform Stored Cross-Site Scripting attacks

Affected:

up to 3.9.21

Fixed in:

3.9.21

Disclosed:

Oct 4, 2021

CVE-2021-24678 on NVD →

The CM Tooltip Glossary plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.9.20 due to insufficient input sanitization and output escaping. It does not escape some glossary_tooltip shortcode attributes. This makes it possible for Contributor-level attackers to inject...

CVSS:

5.4

Affected:

up to 3.9.21

Fixed in:

3.9.21

Disclosed:

Sep 6, 2021

CVE-2021-24678 on NVD →

Reflected XSS in wordpress plugin enhanced-tooltipglossary v3.3.4 via the itemsnumber parameter.

CVSS:

6.1

Affected:

up to 3.3.5

Fixed in:

3.3.5

Disclosed:

Oct 12, 2016

CVE-2016-1000132 on NVD →

[en] Reflected XSS in wordpress plugin enhanced-tooltipglossary v3.2.8

Affected:

up to 3.3.5

Fixed in:

3.3.5

Disclosed:

Oct 10, 2016

CVE-2016-1000132 on NVD →

This plugin is prone to a cross site scripting vulnerability. Update this plugin.

Affected:

up to 3.3.5

Fixed in:

3.3.5

Disclosed:

May 11, 2016

The CM Tooltip Glossary – Better SEO and UEX for your WP site plugin for WordPress is vulnerable to reflected Cross-Site Scripting due to the use of add_query_arg/remove_query_arg without appropriate sanitization and escaping in versions up to, and including 3.1.3.

CVSS:

6.1

Affected:

up to 3.1.3

Fixed in:

3.1.4

Disclosed:

Apr 22, 2015

The CM Tooltip Glossary – Better SEO and UEX for your WP site plugin for WordPress is vulnerable to reflected Cross-Site Scripting due to the use of add_query_arg/remove_query_arg without appropriate sanitization and escaping in versions up to, and including 3.1.3.

Affected:

up to 3.1.4

Fixed in:

3.1.4

Disclosed:

Apr 22, 2015

Affected:

up to 4.3.4

Fixed in:

4.3.4

CVE-2024-5026 on NVD →