CVE-2024-13388: 
WordPress vulnerability analysis and mitigation

The TCBD Tooltip plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2024-13388) discovered in all versions up to and including 1.0. The vulnerability was identified on January 14, 2025, and the plugin was subsequently closed on February 20, 2025, pending a full security review. The vulnerability affects the plugin's 'tcbdtooltip_text' shortcode functionality (CVE Mitre, WordPress Plugin).

The vulnerability stems from insufficient input sanitization and output escaping on user-supplied attributes in the 'tcbdtooltip_text' shortcode. The vulnerability has been assigned a CVSS score of 6.4 (Medium), indicating a moderate severity level (Wordfence).

When exploited, this vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page, potentially leading to unauthorized data access or manipulation (CVE Mitre).

The vulnerability requires an authenticated user with at least contributor-level access to exploit. This requirement somewhat limits the potential attack surface, as it cannot be exploited by unauthenticated users (CVE Mitre).

As of February 20, 2025, the plugin has been temporarily closed and is not available for download pending a full security review. Website administrators using this plugin should consider disabling it until a patched version is released (WordPress Plugin).