PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-8894 vinaysankhyan CVE debrief

A stored cross-site scripting (XSS) vulnerability exists in the iWR Tooltip WordPress plugin, affecting versions up to and including 1.0. The flaw resides in the plugin's `iwrtooltip` shortcode handler, where the `title` attribute is concatenated directly into HTML output without proper escaping via `esc_attr()` or equivalent sanitization. This allows authenticated attackers with contributor-level privileges or higher to inject arbitrary JavaScript that executes when other users view affected pages. The vulnerability was disclosed on 2026-05-27 and carries a CVSS 3.1 score of 6.4 (Medium severity). No known exploitation in the wild or ransomware campaign use has been reported.

Vendor
vinaysankhyan
Product
iWR Tooltip
CVSS
MEDIUM 6.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-27
Advisory published
2026-05-27
Advisory updated
2026-05-27

Who should care

WordPress site administrators using the iWR Tooltip plugin; security teams managing WordPress content management systems; developers maintaining plugins with shortcode functionality

Technical summary

The iWR Tooltip plugin registers a shortcode `iwrtooltip` that renders HTML output. The `iwr_tooltip()` function processes user-supplied attributes, including `title`, and directly embeds this value into a generated HTML attribute string without applying `esc_attr()`, `htmlspecialchars()`, or WordPress's `wp_kses()` sanitization. This omission permits attribute-level XSS injection. The vulnerability requires authenticated access (contributor or higher) to create or edit posts containing the malicious shortcode. The stored payload executes in the browser context of any user viewing the affected content, enabling session hijacking, credential theft, or administrative action forgery.

Defensive priority

medium

Recommended defensive actions

  • Update iWR Tooltip plugin to a version newer than 1.0 if available, or remove the plugin if no patch is released
  • Review existing posts and pages for unauthorized use of the `[iwrtooltip]` shortcode, particularly examining the `title` attribute for suspicious content
  • Implement Content Security Policy (CSP) headers to mitigate impact of any injected scripts
  • Restrict contributor and author role permissions where possible, following principle of least privilege
  • Enable WordPress automatic updates for plugins to receive security patches promptly
  • Consider using a Web Application Firewall (WAF) rule to detect and block suspicious shortcode attribute patterns

Evidence notes

Vulnerability confirmed via Wordfence security advisory and WordPress plugin repository source code review. CWE-79 (Improper Neutralization of Input During Web Page Generation) identified as primary weakness. CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N.

Official resources

2026-05-27