The Tooltip plugin for WordPress is vulnerable to stored cross‑site scripting. When an authenticated contributor or higher user inserts a shortcode with arbitrary attributes, the plugin fails to sanitize or escape those attributes, causing the malicious code to be stored in the page content. When any user views that content, the script is executed in their browser, potentially allowing the attacker to steal the user’s session cookies, alter the page, or perform other malicious actions.

WordPress sites that have the Tooltip plugin installed, versions 1.0.2 or earlier. The vulnerability exists regardless of other plugins or themes; it specifically affects the plugin’s shortcode handling.

The severity score of 6.4 and an EPSS lower than 1 % point to a moderate risk with a low probability of exploitation in the wild. Because the flaw requires authentication with contributor level or higher, a typical attacker must control or compromise a privileged account, but once in hand they can target any user who views injected content. The exploit path is straightforward: create a post with a malicious‑attribute shortcode, which is stored and then served to all visitors. As the exploit is simple and its impact is exactly that of stored XSS, a site owner should treat it as a non‑critical but actionable issue if no immediate patch is available.