CVE-2025-46449: 
WordPress vulnerability analysis and mitigation

A Stored Cross-Site Scripting (XSS) vulnerability has been identified in Novium WoWHead Tooltips plugin versions through 2.0.1. The vulnerability was discovered by researcher johska and was officially disclosed on April 24, 2025, receiving the identifier CVE-2025-46449. The vulnerability affects the WordPress plugin WoWHead Tooltips and involves improper neutralization of input during web page generation (Patchstack, NVD).

The vulnerability has been classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). It received a CVSS v3.1 base score of 7.1 (HIGH) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. The vulnerability requires contributor-level privileges to exploit (Patchstack).

The vulnerability allows malicious actors to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website. These injected scripts will be executed when guests visit the affected site (Patchstack).

The vulnerability requires contributor-level access to exploit and has been classified as having a low patch priority. Despite the high CVSS score, Patchstack has indicated that the security issue has a low severity impact and is unlikely to be exploited (Patchstack).

Currently, no official fix is available for this vulnerability. The issue affects versions up to and including 2.0.1 of the WoWHead Tooltips plugin (Patchstack).