What is the CVSS score of EUVD-2026-35314?

EUVD-2026-35314 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

jQuery Hover Footnotes EUVD-2026-35314

| CVE-2026-10553 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-06-09 Wordfence

GHSA-ccr8-xm74-43hp

CSRF XSS WordPress

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 05:30 vuln.today

CVE Published

Jun 09, 2026 - 03:41 nvd

MEDIUM 4.3

DescriptionCVE.org

The jQuery Hover Footnotes plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4. This is due to missing or incorrect nonce validation on the jqFootnotes_options_subpanel function. This makes it possible for unauthenticated attackers to update the plugin's settings with arbitrary values that, because option values such as jqfoot_anchor_open, jqfoot_anchor_close, and jqfoot_title are echoed unescaped into frontend page content, can be chained into persistent Cross-Site Scripting affecting all site visitors via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Successful exploitation of the CSRF vulnerability can be chained into stored Cross-Site Scripting, as the overwritten option values are persisted via update_option() without sanitization and rendered unescaped on the frontend.

AnalysisAI

Cross-Site Request Forgery in the jQuery Hover Footnotes WordPress plugin (all versions up to and including 1.4) enables unauthenticated remote attackers to chain CSRF into persistent stored Cross-Site Scripting affecting every visitor on the compromised site. The plugin's jqFootnotes_options_subpanel function lacks proper nonce validation, allowing a forged request to overwrite settings such as jqfoot_anchor_open, jqfoot_anchor_close, and jqfoot_title with arbitrary HTML or JavaScript. Because these values are persisted via WordPress's update_option() without sanitization and rendered unescaped in frontend page output, a single successful social-engineering action against one administrator produces site-wide persistent XSS. No public exploit code is identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.

Technical ContextAI

The affected component is the jQuery Hover Footnotes WordPress plugin (CPE: cpe:2.3:a:weaverlancegmailcom:jquery_hover_footnotes:*:*:*:*:*:*:*:*) developed under the identifier weaverlancegmailcom. The root cause is CWE-352 (Cross-Site Request Forgery), specifically missing or incorrect nonce validation in the jqFootnotes_options_subpanel function, visible at jqFootnotes.php lines 56-57 and 159 in the plugin's WordPress.org repository. WordPress's standard protection for admin form submissions is the wp_nonce_field/check_admin_referer mechanism; its absence means the browser's same-origin policy does not prevent forged cross-origin POST requests. The secondary impact - stored XSS - arises because the overwritten option values (jqfoot_anchor_open, jqfoot_anchor_close, jqfoot_title) are passed through update_option() without sanitization and subsequently echoed unescaped into HTML on frontend page loads, bypassing WordPress's expected output-escaping conventions such as esc_attr() or esc_html().

RemediationAI

No vendor-released patch has been identified at time of analysis; no fixed version number is present in the available references or Wordfence advisory data. Site administrators should immediately deactivate and uninstall the jQuery Hover Footnotes plugin until a patched release is confirmed. The Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/c174887b-e24d-4100-97da-8e0923ebafe5) should be monitored for patch availability. As a compensating control, web application firewalls with WordPress rulesets (including Wordfence's own firewall) may detect and block forged requests targeting the plugin's settings endpoint, though WAF bypass is possible and this is not a substitute for patching. Restricting wp-admin access by IP, enforcing multi-factor authentication for administrator accounts, and using Content Security Policy headers on the frontend to limit script execution can reduce the blast radius of a successful stored XSS payload. Note that CSP alone does not prevent the CSRF write path - it only limits XSS impact after the fact.