CVE-2018-1000512

Tooltipy Tooltipy (tooltips for WP) version 5 contains a Cross Site Scripting (XSS) vulnerability in Glossary shortcode that can result in could allow anybody to do almost anything an admin can. This attack appear to be exploitable via Admin must follow a link. This vulnerability appears to have been fixed in 5.1.

• CWE-79

• https://advisories.dxw.com/advisories/xss-in-tooltipy/Exploit, Third Party Advisory
• https://advisories.dxw.com/advisories/xss-in-tooltipy/Exploit, Third Party Advisory

Published

Jun 26, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-1000506Metronet Tag Manager version 1.2.7 contains a Cross ite Requ…
• CVE-2018-1000507WP User Groups version 2.0.0 contains a Cross ite Request Fo…
• CVE-2018-1000508WP ULike version 2.8.1, 3.1 contains a Cross Site Scripting …
• CVE-2018-1000509Redirection version 2.7.1 contains a Serialisation vulnerabi…
• CVE-2018-1000510WP Image Zoom version 1.23 contains a Incorrect Access Contr…
• CVE-2018-1000511WP ULike version 2.8.1, 3.1 contains a Incorrect Access Cont…
• CVE-2018-1000513LimeSurvey version 3.0.0-beta.3+17110 contains a Cross Site …
• CVE-2018-1000514LimeSurvey version 3.0.0-beta.3+17110 contains a Cross ite R…
• CVE-2018-1000515ventrian News-Articles version NewsArticles.00.09.11 contain…
• CVE-2018-1000516The Galaxy Project Galaxy version v14.10 contains a CWE-79: …
• CVE-2018-1000517BusyBox project BusyBox wget version prior to commit 8e2174e…9.8
• CVE-2018-1000518aaugustin websockets version 4 contains a CWE-409: Improper …7.5