Stored Cross-Site Scripting Vulnerability in iWR Tooltip Plugin for WordPress

CVE-2026-8894

What is CVE-2026-8894?

The iWR Tooltip plugin for WordPress suffers from a stored cross-site scripting vulnerability that affects versions up to and including 1.0. This flaw arises from insufficient sanitization of user inputs, specifically in the iwrtooltip shortcode. The title attribute within this shortcode is not properly escaped, allowing authenticated attackers with contributor-level access to inject malicious scripts into web pages. These scripts execute whenever another user visits the altered page, posing significant risks to site integrity and user security.

References