CVE-2024-13388: 
WordPress vulnerability analysis and mitigation

The TCBD Tooltip plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2024-13388) discovered in all versions up to and including 1.0. The vulnerability was identified on January 14, 2025, and the plugin was subsequently closed on February 20, 2025, pending a full security review. The vulnerability affects the plugin's 'tcbdtooltip_text' shortcode functionality (CVE Mitre, WordPress Plugin).

The vulnerability stems from insufficient input sanitization and output escaping on user-supplied attributes in the 'tcbdtooltip_text' shortcode. The vulnerability has been assigned a CVSS score of 6.4 (Medium), indicating a moderate severity level (Wordfence).

When exploited, this vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page, potentially leading to unauthorized data access or manipulation (CVE Mitre).

As of February 20, 2025, the plugin has been temporarily closed and is not available for download pending a full security review. Website administrators using this plugin should consider disabling it until a patched version is released (WordPress Plugin).