{"api_version":"1","generated_at":"2026-07-23T12:48:16+00:00","cve":"CVE-2018-1000512","urls":{"html":"https://cve.report/CVE-2018-1000512","api":"https://cve.report/api/cve/CVE-2018-1000512.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2018-1000512","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000512"},"summary":{"title":"CVE-2018-1000512","description":"Tooltipy Tooltipy (tooltips for WP) version 5 contains a Cross Site Scripting (XSS) vulnerability in Glossary shortcode that can result in could allow anybody to do almost anything an admin can. This attack appear to be exploitable via Admin must follow a link. This vulnerability appears to have been fixed in 5.1.","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2018-06-26 16:29:00","updated_at":"2018-08-20 15:48:00"},"problem_types":["CWE-79"],"metrics":[],"references":[{"url":"https://advisories.dxw.com/advisories/xss-in-tooltipy/","name":"https://advisories.dxw.com/advisories/xss-in-tooltipy/","refsource":"MISC","tags":["Exploit","Third Party Advisory"],"title":"Reflected XSS in Tooltipy (tooltips for WP) could allow anybody to do almost anything an admin can – dxw advisories","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1000512","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000512","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2018","cve_id":"1000512","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"tooltipy_project","cpe5":"tooltipy","cpe6":"5.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"1000512","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"tooltipy_project","cpe5":"tooltipy","cpe6":"5.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","DATE_ASSIGNED":"2018-06-23T11:22:33.013855","DATE_REQUESTED":"2018-06-12T19:44:46","ID":"CVE-2018-1000512","REQUESTER":"tom@dxw.com","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Tooltipy Tooltipy (tooltips for WP) version 5 contains a Cross Site Scripting (XSS) vulnerability in Glossary shortcode that can result in could allow anybody to do almost anything an admin can. This attack appear to be exploitable via Admin must follow a link. This vulnerability appears to have been fixed in 5.1."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"https://advisories.dxw.com/advisories/xss-in-tooltipy/","refsource":"MISC","url":"https://advisories.dxw.com/advisories/xss-in-tooltipy/"}]}},"nvd":{"publishedDate":"2018-06-26 16:29:00","lastModifiedDate":"2018-08-20 15:48:00","problem_types":["CWE-79"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM"},"exploitabilityScore":2.8,"impactScore":2.7},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE","baseScore":4.3},"severity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:tooltipy_project:tooltipy:5.0:*:*:*:*:wordpress:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2018","CveId":"1000512","Ordinal":"129233","Title":"CVE-2018-1000512","CVE":"CVE-2018-1000512","Year":"2018"},"notes":[{"CveYear":"2018","CveId":"1000512","Ordinal":"1","NoteData":"Tooltipy Tooltipy (tooltips for WP) version 5 contains a Cross Site Scripting (XSS) vulnerability in Glossary shortcode that can result in could allow anybody to do almost anything an admin can. This attack appear to be exploitable via Admin must follow a link. This vulnerability appears to have been fixed in 5.1.","Type":"Description","Title":null},{"CveYear":"2018","CveId":"1000512","Ordinal":"2","NoteData":"2018-06-26","Type":"Other","Title":"Published"},{"CveYear":"2018","CveId":"1000512","Ordinal":"3","NoteData":"2018-06-26","Type":"Other","Title":"Modified"}]}}}