Executive brief
The jQuery Hover Footnotes plugin for WordPress, which displays footnote previews on websites, contains a security flaw that allows attackers to change its settings without authorization. By tricking a site administrator into clicking a malicious link, an attacker can inject harmful scripts into the website. This could lead to the compromise of site visitors' browsers or the defacement of the website.
Technical details
The jQuery Hover Footnotes plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) due to missing nonce validation in the jqFootnotes_options_subpanel function. An unauthenticated attacker can exploit this by tricking a site administrator into submitting a forged request, allowing the attacker to update plugin settings with arbitrary values. Because specific options like 'jqfoot_anchor_open' and 'jqfoot_title' are saved via update_option() without sanitization and subsequently rendered unescaped on the frontend, this vulnerability can be chained into a persistent Cross-Site Scripting (XSS) attack. This allows for the execution of malicious scripts in the context of any visitor's browser. All versions up to and including 1.4 are affected.
Affected products
- WordPress jQuery Hover Footnotes Up to and including 1.4
Timeline
- 2026-06-09: disclosed: Initial disclosure by Wordfence and NVD publication.
References
- https://plugins.trac.wordpress.org/browser/jquery-hover-footnotes/trunk/jqFootnotes.php
- https://plugins.trac.wordpress.org/browser/jquery-hover-footnotes/trunk/jqFootnotes.php
- https://plugins.trac.wordpress.org/browser/jquery-hover-footnotes/trunk/jqFootnotes.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/c174887b-e24d-4100-97da-8e0923ebafe5?source=cve