Novium’s WoWHead Tooltips plugin contains an improper input neutralization flaw that permits an attacker to store malicious script code within the plugin’s configuration or content fields. The vulnerability allows a stored XSS attack, enabling the injection of arbitrary client‑side code into rendered web pages. This can compromise user credentials, deface the site, or facilitate further attacks in the victim’s browser, impacting confidentiality, integrity, and availability of the affected WordPress installation.

The flaw affects all releases of the WoWHead Tooltips plugin up to and including version 2.0.1. WordPress sites that have installed or upgraded to these versions are vulnerable unless they have applied a later patch or removed the plugin entirely.

The CVSS score of 7.1 indicates high risk from an application perspective. The EPSS score of less than 1% suggests that, as of this analysis, exploitation is unlikely in the wild, and the vulnerability is not listed in CISA’s KEV catalog. Nonetheless, because the flaw is stored XSS, the attack vector is likely remote: any user or attacker who can inject content into the plugin’s input fields can store malicious code that will run in the browsers of all site visitors. The impact is continuous until the plugin is updated or removed.