The vulnerability is an improper neutralization of user input during web page generation, which allows an attacker to store malicious scripts in the Tooltipy WordPress plugin. When a site visitor loads a page that contains the stored payload, the script executes within the visitor’s browser context. This can lead to defacement, theft of session cookies, credential harvesting, or delivery of further malware. The flaw is a classic Stored XSS, classified as CWE‑79.

The issue affects the Jamel.Z Tooltipy plugin (bluet‑keywords‑tooltip‑generator) for WordPress, specifically all versions up to and including 5.5.6. Users running any of those releases are potentially vulnerable until an update is applied.

The CVSS score of 6.5 indicates a moderate severity level, while the EPSS score of less than 1% shows a low likelihood of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely abused. Attackers would need access to the plugin’s input areas, often requiring administrative privileges, but the stored nature of the flaw means the impact occurs for any visitor to the affected pages.