The WP Smart Tooltip plugin by Nurul Amin suffers from a stored XSS vulnerability due to improper input neutralization during web page generation. This allows an attacker with low privileges and requiring user interaction to inject malicious scripts that can impact confidentiality, integrity, and availability to a limited extent. The vulnerability affects all versions up to 1.0.0. No patch or vendor advisory has been provided yet, and no exploits are known in the wild.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of other users, potentially leading to information disclosure, session hijacking, or other impacts on confidentiality, integrity, and availability. The CVSS score of 6.5 reflects a medium severity with network attack vector, low attack complexity, requiring low privileges and user interaction, and partial impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict plugin usage to trusted users and consider disabling or removing the plugin if possible to mitigate risk.