CVE-2024-35756 describes a stored XSS vulnerability in the CeiKay Tooltip CK plugin (up to version 2.2.15) caused by improper input neutralization during web page generation. This weakness (CWE-79) allows attackers with high privileges and user interaction to inject malicious scripts that can compromise confidentiality, integrity, and availability to a limited extent. The vulnerability has a CVSS 3.1 base score of 5.9, reflecting network attack vector, low attack complexity, required privileges, and user interaction with partial impact on confidentiality, integrity, and availability. No patch or official remediation has been published yet.

Successful exploitation of this stored XSS vulnerability could allow an attacker with high privileges to inject malicious scripts that execute in the context of other users' browsers, potentially leading to partial disclosure of information, modification of data, or disruption of service. However, exploitation requires user interaction and elevated privileges, limiting the overall impact. No active exploits are currently known.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin to trusted users only and consider disabling or removing the Tooltip CK plugin if feasible. Monitor vendor channels for updates and apply patches promptly once released.