The vulnerability in the Tips Shortcode plugin allows authenticated attackers with contributor or higher privileges to inject arbitrary JavaScript into the ‘tip’ shortcode. Because the plugin fails to properly sanitize input and escape output, the malicious script is stored and executed whenever a user views a page containing the injected tip. The result is that any site visitor who views the affected page can be subjected to client‑side attacks such as session hijacking, cookie theft or phishing. The flaw is a classic Stored XSS (CWE‑79).

WordPress sites using the Tips Shortcode plugin (vendor fpcorso) are affected. All releases up to and including 0.2.1 contain the flaw; any site running those versions is vulnerable.

The CVSS score of 6.4 indicates a moderate security impact. The EPSS score of < 1% shows that, at the time of analysis, the likelihood of exploitation is very low, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to gain authenticated access with contributor‑level rights to the WordPress installation and then create or edit a tip using the vulnerable shortcode. Once the malicious script is stored, every visitor to the tip page becomes exposed to the XSS payload, creating a widespread impact for the site’s user base.