Jquery Hover Footnotes
Monthly
Cross-Site Request Forgery in the jQuery Hover Footnotes WordPress plugin (all versions up to and including 1.4) enables unauthenticated remote attackers to chain CSRF into persistent stored Cross-Site Scripting affecting every visitor on the compromised site. The plugin's jqFootnotes_options_subpanel function lacks proper nonce validation, allowing a forged request to overwrite settings such as jqfoot_anchor_open, jqfoot_anchor_close, and jqfoot_title with arbitrary HTML or JavaScript. Because these values are persisted via WordPress's update_option() without sanitization and rendered unescaped in frontend page output, a single successful social-engineering action against one administrator produces site-wide persistent XSS. No public exploit code is identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
We are tasked with producing a JSON analysis for CVE-2026-10738. We have data from description, CVSS, EPSS, CWE, CPE, tags, SSVC, EUVD, and references. Need to produce a thorough synthesis. First, parse all fields. The description says: "The jQuery Hover Footnotes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Footnote Qualifier ('{{...}}' Syntax) in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The attribute-breakout payload (e.g., a double-quote followed by an event handler) contains no angle brackets and therefore bypasses WordPress core's wp_kses_post() filtering, which only strips disallowed HTML tags rather than sanitizing attribute contexts." CVSS: 6.4, vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. CWE-79 (Cross-Site Scripting). EPSS 0.03% (percentile 10%). Reported by Wordfence. CPE: cpe:2.3:a:weaverlancegmailcom:jquery_hover_footnotes:*:*:*:*:*:*:*:*. Tags: XSS, WordPress, Jquery Hover Footnotes. SSVC: Exploitation: none, Automatable: no, Technical Impact: partial. EUVD ID: EUVD-2026-35312, affected versions: jQuery Hover Footnotes 0 ≤ 1.4. References from Wordfence and plugin trac links. Now, we'll craft each JSON field. product_name: "jQuery Hover Footnotes" — 3 words. Might be "Jquery Hover Footnotes". The plugin name as per tags and CPE: "jquery_hover_footnotes". So "jQuery Hover Footnotes" would be appropriate. Put exactly as capitalised? CPE uses "jquery_hover_footnotes" but description capitalizes "jQuery Hover Footnotes". I'll go with "jQuery Hover Footnotes". summary: Need an original synthesis, not just paraphrasing. Start with specific impact verb and product. E.g., "Stored cross-site scripting in jQuery Hover Footnotes plugin for WordPress allows...". The issue is stored X
Cross-Site Request Forgery in the jQuery Hover Footnotes WordPress plugin (all versions up to and including 1.4) enables unauthenticated remote attackers to chain CSRF into persistent stored Cross-Site Scripting affecting every visitor on the compromised site. The plugin's jqFootnotes_options_subpanel function lacks proper nonce validation, allowing a forged request to overwrite settings such as jqfoot_anchor_open, jqfoot_anchor_close, and jqfoot_title with arbitrary HTML or JavaScript. Because these values are persisted via WordPress's update_option() without sanitization and rendered unescaped in frontend page output, a single successful social-engineering action against one administrator produces site-wide persistent XSS. No public exploit code is identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
We are tasked with producing a JSON analysis for CVE-2026-10738. We have data from description, CVSS, EPSS, CWE, CPE, tags, SSVC, EUVD, and references. Need to produce a thorough synthesis. First, parse all fields. The description says: "The jQuery Hover Footnotes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Footnote Qualifier ('{{...}}' Syntax) in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The attribute-breakout payload (e.g., a double-quote followed by an event handler) contains no angle brackets and therefore bypasses WordPress core's wp_kses_post() filtering, which only strips disallowed HTML tags rather than sanitizing attribute contexts." CVSS: 6.4, vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. CWE-79 (Cross-Site Scripting). EPSS 0.03% (percentile 10%). Reported by Wordfence. CPE: cpe:2.3:a:weaverlancegmailcom:jquery_hover_footnotes:*:*:*:*:*:*:*:*. Tags: XSS, WordPress, Jquery Hover Footnotes. SSVC: Exploitation: none, Automatable: no, Technical Impact: partial. EUVD ID: EUVD-2026-35312, affected versions: jQuery Hover Footnotes 0 ≤ 1.4. References from Wordfence and plugin trac links. Now, we'll craft each JSON field. product_name: "jQuery Hover Footnotes" — 3 words. Might be "Jquery Hover Footnotes". The plugin name as per tags and CPE: "jquery_hover_footnotes". So "jQuery Hover Footnotes" would be appropriate. Put exactly as capitalised? CPE uses "jquery_hover_footnotes" but description capitalizes "jQuery Hover Footnotes". I'll go with "jQuery Hover Footnotes". summary: Need an original synthesis, not just paraphrasing. Start with specific impact verb and product. E.g., "Stored cross-site scripting in jQuery Hover Footnotes plugin for WordPress allows...". The issue is stored X