CVE-2026-8894

Vulnerability

The iWR Tooltip plugin for WordPress versions up to and including 1.0 is vulnerable to Stored Cross-Site Scripting (XSS) through its [iwrtooltip] shortcode. The iwr_tooltip() function directly concatenates the user-supplied title attribute into an HTML link tag without applying esc_attr() or any sanitization or escaping [1][2]. This allows attackers to inject arbitrary HTML and JavaScript into the page content.

Exploitation

An attacker must have at least Contributor-level access to a WordPress site (the role can publish posts/pages but not necessarily unfiltered HTML via the editor). The attacker creates or edits a post/page using the [iwrtooltip] shortcode and supplies a malicious payload in the title attribute, for example: [iwrtooltip title=" onclick=alert(1) "]test[/iwrtooltip]. The shortcode outputs the unsanitized title value directly into the title attribute of an `` tag, resulting in script execution when the page is viewed [1][2]. The injected script is saved in the database and executed for every visitor to the affected page — no further user interaction is needed.

Impact

Successful exploitation leads to persistent execution of attacker-controlled JavaScript in the context of any user viewing the compromised page. This can be used to steal session cookies, perform actions on behalf of the victim (e.g., create administrative accounts), redirect users to malicious sites, or deface the page. The attacker's script runs at the privilege level of the logged-in user viewing the page, potentially compromising site integrity and confidentiality.

Mitigation

The vendor has not released a patched version as of the publication date (2026-05-27) [1][2]. Site administrators should immediately remove or disable the iWR Tooltip plugin if it is installed. As a temporary workaround, administrators can restrict shortcode usage to trusted users only via roles and capabilities (e.g., using a plugin that controls shortcode access), or apply a virtual patch via a Web Application Firewall (WAF) that blocks known XSS payloads in title attributes of the shortcode. No upstream fix is currently available. This CVE is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog as of publication.