CVE-2025-58614: 
WordPress vulnerability analysis and mitigation

A stored Cross-Site Scripting (XSS) vulnerability was discovered in Jamel.Z's Tooltipy WordPress plugin, tracked as CVE-2025-58614. The vulnerability affects versions through 5.5.6 and was disclosed on September 3, 2025. The issue stems from improper neutralization of input during web page generation (AttackerKB, Patchstack).

The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (Medium severity). The attack vector is network-based (AV:N) with low attack complexity (AC:L), requiring low privileges (PR:L) and user interaction (UI:R). The scope is changed (S:C) with low impact on confidentiality, integrity, and availability (C:L/I:L/A:L) (AttackerKB).

If exploited, this vulnerability could allow attackers to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website. These injected scripts would be executed when visitors access the affected site (Patchstack).

The vulnerability requires contributor-level privileges or higher to exploit, making it an authenticated stored XSS vulnerability. The attack complexity is considered low, though user interaction is required for successful exploitation (Patchstack).

The vulnerability has been patched in version 5.5.9 of the Tooltipy plugin. Users are advised to update to version 5.5.9 or later to remediate the security issue. The vulnerability is considered to have a low severity impact and is unlikely to be exploited (Patchstack).