Threat Entry Updated 2025-06-10

CVE-2024-5026 - Cm Tooltip Glossary Plugin

The CM Tooltip Glossary WordPress plugin before 4.3.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

PLUGIN Cm Tooltip Glossary

CVE-2024-5026

MEDIUM CVSS 4.8 2025-05-15

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-21

CVE-2021-24678 - Cm Tooltip Glossary Plugin

The CM Tooltip Glossary WordPress plugin before 3.9.21 does not escape some glossary_tooltip shortcode attributes, which could allow users a role as low as Contributor to perform Stored Cross-Site Scripting attacks

PLUGIN Cm Tooltip Glossary

CVE-2021-24678

MEDIUM CVSS 5.4 2021-10-04

Risk Score

Open Full Technical Breakdown