Skip to main content

Jquery Hover Footnotes

2 CVEs product

Monthly

CVE-2026-10553 Jun 09, 03:41 MEDIUM This Month

Cross-Site Request Forgery in the jQuery Hover Footnotes WordPress plugin (all versions up to and including 1.4) enables unauthenticated remote attackers to chain CSRF into persistent stored Cross-Site Scripting affecting every visitor on the compromised site. The plugin's jqFootnotes_options_subpanel function lacks proper nonce validation, allowing a forged request to overwrite settings such as jqfoot_anchor_open, jqfoot_anchor_close, and jqfoot_title with arbitrary HTML or JavaScript. Because these values are persisted via WordPress's update_option() without sanitization and rendered unescaped in frontend page output, a single successful social-engineering action against one administrator produces site-wide persistent XSS. No public exploit code is identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.

WordPress XSS CSRF Wordpress Plugin Jquery Hover Footnotes
NVD
CVSS 3.1
4.3
EPSS
0.0%
CVE-2026-10738 Jun 09, 03:41 MEDIUM This Month

We are tasked with producing a JSON analysis for CVE-2026-10738. We have data from description, CVSS, EPSS, CWE, CPE, tags, SSVC, EUVD, and references. Need to produce a thorough synthesis. First, parse all fields. The description says: "The jQuery Hover Footnotes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Footnote Qualifier ('{{...}}' Syntax) in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The attribute-breakout payload (e.g., a double-quote followed by an event handler) contains no angle brackets and therefore bypasses WordPress core's wp_kses_post() filtering, which only strips disallowed HTML tags rather than sanitizing attribute contexts." CVSS: 6.4, vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. CWE-79 (Cross-Site Scripting). EPSS 0.03% (percentile 10%). Reported by Wordfence. CPE: cpe:2.3:a:weaverlancegmailcom:jquery_hover_footnotes:*:*:*:*:*:*:*:*. Tags: XSS, WordPress, Jquery Hover Footnotes. SSVC: Exploitation: none, Automatable: no, Technical Impact: partial. EUVD ID: EUVD-2026-35312, affected versions: jQuery Hover Footnotes 0 ≤ 1.4. References from Wordfence and plugin trac links. Now, we'll craft each JSON field. product_name: "jQuery Hover Footnotes" — 3 words. Might be "Jquery Hover Footnotes". The plugin name as per tags and CPE: "jquery_hover_footnotes". So "jQuery Hover Footnotes" would be appropriate. Put exactly as capitalised? CPE uses "jquery_hover_footnotes" but description capitalizes "jQuery Hover Footnotes". I'll go with "jQuery Hover Footnotes". summary: Need an original synthesis, not just paraphrasing. Start with specific impact verb and product. E.g., "Stored cross-site scripting in jQuery Hover Footnotes plugin for WordPress allows...". The issue is stored X

WordPress XSS Wordpress Plugin Jquery Hover Footnotes
NVD
CVSS 3.1
6.4
EPSS
0.0%
EPSS 0% CVSS 4.3
MEDIUM This Month

Cross-Site Request Forgery in the jQuery Hover Footnotes WordPress plugin (all versions up to and including 1.4) enables unauthenticated remote attackers to chain CSRF into persistent stored Cross-Site Scripting affecting every visitor on the compromised site. The plugin's jqFootnotes_options_subpanel function lacks proper nonce validation, allowing a forged request to overwrite settings such as jqfoot_anchor_open, jqfoot_anchor_close, and jqfoot_title with arbitrary HTML or JavaScript. Because these values are persisted via WordPress's update_option() without sanitization and rendered unescaped in frontend page output, a single successful social-engineering action against one administrator produces site-wide persistent XSS. No public exploit code is identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.

WordPress XSS CSRF +2
NVD
EPSS 0% CVSS 6.4
MEDIUM This Month

We are tasked with producing a JSON analysis for CVE-2026-10738. We have data from description, CVSS, EPSS, CWE, CPE, tags, SSVC, EUVD, and references. Need to produce a thorough synthesis. First, parse all fields. The description says: "The jQuery Hover Footnotes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Footnote Qualifier ('{{...}}' Syntax) in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The attribute-breakout payload (e.g., a double-quote followed by an event handler) contains no angle brackets and therefore bypasses WordPress core's wp_kses_post() filtering, which only strips disallowed HTML tags rather than sanitizing attribute contexts." CVSS: 6.4, vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. CWE-79 (Cross-Site Scripting). EPSS 0.03% (percentile 10%). Reported by Wordfence. CPE: cpe:2.3:a:weaverlancegmailcom:jquery_hover_footnotes:*:*:*:*:*:*:*:*. Tags: XSS, WordPress, Jquery Hover Footnotes. SSVC: Exploitation: none, Automatable: no, Technical Impact: partial. EUVD ID: EUVD-2026-35312, affected versions: jQuery Hover Footnotes 0 ≤ 1.4. References from Wordfence and plugin trac links. Now, we'll craft each JSON field. product_name: "jQuery Hover Footnotes" — 3 words. Might be "Jquery Hover Footnotes". The plugin name as per tags and CPE: "jquery_hover_footnotes". So "jQuery Hover Footnotes" would be appropriate. Put exactly as capitalised? CPE uses "jquery_hover_footnotes" but description capitalizes "jQuery Hover Footnotes". I'll go with "jQuery Hover Footnotes". summary: Need an original synthesis, not just paraphrasing. Start with specific impact verb and product. E.g., "Stored cross-site scripting in jQuery Hover Footnotes plugin for WordPress allows...". The issue is stored X

WordPress XSS Wordpress Plugin +1
NVD

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy