The iWR Tooltip plugin for WordPress, versions up to 1.0, contains a stored cross‑site scripting flaw in the iwrtooltip shortcode. The plugin fails to sanitize or escape the title attribute supplied by users, concatenating the value directly into an HTML attribute. An attacker who can add or edit content with contributor or higher privileges can place arbitrary JavaScript in the title field, which then becomes part of the page’s source and runs for any visitor who loads the page. The weakness is a classic example of CWE‑79.

Vinaysankhyan’s iWR Tooltip plugin installed on WordPress sites, version 1.0 or earlier, is affected. Any site that has granted contributor-level or higher roles to users and uses the iwrtooltip shortcode is at risk.

With a CVSS score of 6.4, the vulnerability is considered moderate. The requirement for authenticated access limits the attack to users who already have contributor or higher permissions. No EPSS score is available, and the flaw is not listed in CISA’s KEV catalog, indicating that large‑scale exploitation has not been documented. Based on the description, it is inferred that the attacker would need to insert a malicious payload into the title attribute of the shortcode, after which the payload becomes stored and will execute whenever any user visits the affected page.