This vulnerability arises from improper neutralization of user input during web page generation, allowing a stored cross‑site scripting (XSS) payload to be executed within the context of the vulnerable site. An attacker could embed malicious JavaScript that runs whenever an affected user visits a page, potentially capturing credentials, session cookies, or defacing content. The weakness is a classic injection flaw (CWE‑79).

The flaw affects the Tooltipy plugin released by Jamel.Z, specifically all versions up to and including 5.5.9. Organizations using any of these releases are considered vulnerable and should review their installed plugin version.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests a very low current exploitation probability. This vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves an attacker gaining write access or overriding the plugin’s input handling to store a payload; subsequent visits to the affected page would trigger execution of that payload.