CVE-2026-8894 Overview
CVE-2026-8894 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the iWR Tooltip plugin for WordPress in versions up to and including 1.0. The flaw resides in the iwrtooltip shortcode handler, where the title attribute is concatenated directly into HTML output without esc_attr() or any equivalent escaping. Authenticated users with contributor-level access or higher can inject arbitrary JavaScript that executes in any visitor's browser when an affected page is loaded. The vulnerability is classified under [CWE-79] Improper Neutralization of Input During Web Page Generation.
Critical Impact
Contributor-level attackers can persist JavaScript payloads in published content, enabling session theft, administrative action forgery, and visitor redirection.
Affected Products
- iWR Tooltip plugin for WordPress — all versions up to and including 1.0
- WordPress sites permitting contributor or higher role registration
- Any site rendering content containing the iwrtooltip shortcode
Discovery Timeline
- 2026-05-27 - CVE-2026-8894 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-8894
Vulnerability Analysis
The iWR Tooltip plugin registers an iwrtooltip shortcode that accepts user-supplied attributes including a title value. According to the WordPress plugin source code, the shortcode handler concatenates the title attribute directly into the output HTML attribute context. WordPress provides the esc_attr() function specifically for sanitizing values placed inside HTML attributes, but the handler omits this call. An attacker can supply a title value that closes the surrounding attribute and introduces an event handler such as onmouseover or onload. When a logged-in editor or administrator views the resulting page, the injected script executes with their session context.
Root Cause
The root cause is missing output escaping on user-controlled shortcode attributes. Shortcode attribute values flow from post content into the rendered HTML through string concatenation. Without esc_attr() wrapping the title parameter, any quote character in the input breaks out of the attribute context and permits new attributes or tags to be introduced into the DOM.
Attack Vector
Exploitation requires an authenticated account at contributor level or above. The attacker creates or edits a post containing the iwrtooltip shortcode with a crafted title attribute. After the post is rendered, any visitor — including site administrators reviewing pending submissions — triggers the payload. Because the script runs in the origin of the WordPress site, it can read authentication cookies not marked HttpOnly, submit privileged forms via the REST API, or pivot to administrative account takeover.
// No verified proof-of-concept code is published.
// Technical details: the iwr_tooltip() handler emits the
// `title` shortcode attribute into an HTML attribute without
// esc_attr(), allowing attribute-context XSS.
// Reference: https://plugins.trac.wordpress.org/browser/iwr-tooltip/tags/1.0/iwr-tooltip.php#L37
Detection Methods for CVE-2026-8894
Indicators of Compromise
- Posts or pages containing [iwrtooltip ...] shortcodes with title attribute values that include quote characters, angle brackets, javascript: URIs, or event handler names such as onerror, onload, or onmouseover.
- Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after viewing contributor-submitted content.
- Newly created administrator accounts or modified user roles following contributor activity.
Detection Strategies
- Query the wp_posts table for post_content matching the regex \[iwrtooltip[^\]]*title="[^"]*[<>"'][^"]*" to surface suspicious shortcode usage.
- Inspect web server access logs for POST requests to /wp-admin/post.php and /wp-admin/admin-ajax.php from contributor accounts that contain encoded payload patterns.
- Review the rendered HTML of pages containing the shortcode for stray on*= event handlers or <script> fragments inside attribute contexts.
Monitoring Recommendations
- Enable WordPress audit logging to capture post creation and update events tied to contributor-level accounts.
- Forward web server and WordPress logs to a centralized analytics platform and alert on shortcode patterns associated with the plugin.
- Monitor administrator session activity for anomalous REST API calls originating from page views of contributor content.
How to Mitigate CVE-2026-8894
Immediate Actions Required
- Deactivate and remove the iWR Tooltip plugin until a patched release is available.
- Audit all existing posts and pages for iwrtooltip shortcode usage and remove or sanitize any instances with suspicious title attributes.
- Restrict contributor-level account creation and review accounts that have submitted content recently.
Patch Information
No patched release is identified in the NVD entry at the time of publication. Versions up to and including 1.0 remain vulnerable. Consult the Wordfence vulnerability report for updated fix availability and the WordPress plugin source for the affected code paths.
Workarounds
- Remove the plugin entirely if tooltip functionality is non-essential.
- Apply a web application firewall rule that blocks requests containing iwrtooltip shortcodes with quote characters or event handler keywords in the title attribute.
- Limit content submission privileges so untrusted users cannot publish or save posts containing shortcodes.
# Remove the vulnerable plugin via WP-CLI
wp plugin deactivate iwr-tooltip
wp plugin delete iwr-tooltip
# Search for residual shortcode usage in post content
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%[iwrtooltip%';"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
