PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-8894 vinaysankhyan CVE debrief

A stored cross-site scripting (XSS) vulnerability exists in the iWR Tooltip WordPress plugin, affecting versions up to and including 1.0. The flaw resides in the plugin's `iwrtooltip` shortcode handler, where the `title` attribute is concatenated directly into HTML output without proper escaping via `esc_attr()` or equivalent sanitization. This allows authenticated attackers with contributor-level privileges or higher to inject arbitrary JavaScript that executes when other users view affected pages. The vulnerability was disclosed on 2026-05-27 and carries a CVSS 3.1 score of 6.4 (Medium severity). No known exploitation in the wild or ransomware campaign use has been reported.

Vendor
vinaysankhyan
Product
iWR Tooltip
CVSS
MEDIUM 6.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-27
Advisory published
2026-05-27
Advisory updated
2026-05-27

Who should care

WordPress site administrators using the iWR Tooltip plugin; security teams managing WordPress content management systems; developers maintaining plugins with shortcode functionality

Technical summary

The iWR Tooltip plugin registers a shortcode `iwrtooltip` that renders HTML output. The `iwr_tooltip()` function processes user-supplied attributes, including `title`, and directly embeds this value into a generated HTML attribute string without applying `esc_attr()`, `htmlspecialchars()`, or WordPress's `wp_kses()` sanitization. This omission permits attribute-level XSS injection. The vulnerability requires authenticated access (contributor or higher) to create or edit posts containing the malicious shortcode. The stored payload executes in the browser context of any user viewing the affected content, enabling session hijacking, credential theft, or administrative action forgery.

Defensive priority

medium

Recommended defensive actions

  • Update iWR Tooltip plugin to a version newer than 1.0 if available, or remove the plugin if no patch is released
  • Review existing posts and pages for unauthorized use of the `[iwrtooltip]` shortcode, particularly examining the `title` attribute for suspicious content
  • Implement Content Security Policy (CSP) headers to mitigate impact of any injected scripts
  • Restrict contributor and author role permissions where possible, following principle of least privilege
  • Enable WordPress automatic updates for plugins to receive security patches promptly
  • Consider using a Web Application Firewall (WAF) rule to detect and block suspicious shortcode attribute patterns

Evidence notes

Vulnerability confirmed via Wordfence security advisory and WordPress plugin repository source code review. CWE-79 (Improper Neutralization of Input During Web Page Generation) identified as primary weakness. CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-8894 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-8894

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-8894 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-8894

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.