The ItayXD Responsive Mobile-Friendly Tooltip plugin versions up to 1.6.6 suffer from a stored Cross-site Scripting vulnerability due to improper input neutralization during web page generation. This vulnerability allows attackers with low privileges and requiring user interaction to inject malicious scripts that execute in the context of affected users' browsers. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, low privileges required, user interaction needed, and impacts to confidentiality, integrity, and availability.

Successful exploitation of this stored XSS vulnerability can lead to partial compromise of confidentiality, integrity, and availability of affected systems or user data. Attackers may execute arbitrary scripts in the context of users' browsers, potentially leading to session hijacking, defacement, or other malicious actions. However, no known exploits in the wild have been reported, and the severity is rated medium.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider restricting input sources, applying web application firewall rules to detect and block XSS payloads, and limiting user privileges where possible. Monitor official ItayXD channels for updates and apply patches promptly once released.