CVE-2026-8894 | vinaysankhyan iWR Tooltip Plugin up to 1.0 on WordPress Shortcode iwr_tooltip Title cross site scripting

A vulnerability, which was classified as problematic, was found in vinaysankhyan iWR Tooltip Plugin up to 1.0 on WordPress. Impacted is the function iwr_tooltip of the component Shortcode Handler. Executing a manipulation of the argument Title can lead to cross site scripting.

This vulnerability is registered as CVE-2026-8894. It is possible to launch the attack remotely. No exploit is available.