Executive brief
The iWR Tooltip plugin for WordPress, which allows site owners to add hover-over information boxes to their content, contains a security flaw. This vulnerability allows users with basic contributor access to inject malicious scripts into website pages. When other visitors or administrators view these pages, the scripts can execute, potentially leading to unauthorized actions or data theft.
Technical details
The iWR Tooltip plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping in the `iwr_tooltip()` shortcode handler. Specifically, the `title` attribute is concatenated directly into an HTML attribute without using protective functions like `esc_attr()`. This allows authenticated attackers with contributor-level permissions or higher to inject arbitrary web scripts into the database. These scripts will execute in the browser of any user who visits the affected page. The vulnerability exists in all versions up to and including 1.0.
Affected products
- iWR Tooltip iWR Tooltip Up to and including 1.0
Timeline
- 2026-05-27: disclosed: Vulnerability published by Wordfence and NVD.