CVE-2021-24678: CM Tooltip Glossary < 3.9.21 - Contributor+ Stored Cross-Site Scripting

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-10-04 · updated 2026-06-17
Weakness: CWE-79

Description

The CM Tooltip Glossary WordPress plugin before 3.9.21 does not escape some glossary_tooltip shortcode attributes, which could allow users a role as low as Contributor to perform Stored Cross-Site Scripting attacks

Affected products

CM Tooltip Glossary – Better SEO and UEX for your WP site: before 3.9.21 — fixed in 3.9.21

How to fix

Upgrade to a fixed version: CM Tooltip Glossary – Better SEO and UEX for your WP site 3.9.21. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/b83880f7-8614-4409-9305-d059b5df15dd
https://wpscan.com/vulnerability/b83880f7-8614-4409-9305-d059b5df15dd

Get alerted when CVE-2021-24678 or the next vulnerability affects your stack