Executive brief
The jQuery Hover Footnotes plugin for WordPress, which allows users to add interactive footnotes to their posts, contains a security flaw that allows attackers to inject malicious scripts. An attacker with author-level permissions can use this vulnerability to embed code that runs in the browsers of visitors who view the affected pages. This could lead to unauthorized actions being performed on behalf of users or the theft of sensitive session information.
Technical details
The jQuery Hover Footnotes plugin for WordPress (versions <= 1.4) is vulnerable to Stored Cross-Site Scripting (XSS) due to improper sanitization of the '{{...}}' footnote qualifier syntax. Authenticated attackers with author-level privileges or higher can inject arbitrary web scripts by using attribute-breakout payloads, such as double-quotes followed by event handlers. Because these payloads do not require angle brackets, they bypass the standard WordPress wp_kses_post() filter, which only targets disallowed HTML tags. When a user visits a page containing the malicious footnote, the script executes in their browser context. As of the advisory date, the vulnerability affects all versions up to 1.4.
Affected products
- WordPress Plugin jQuery Hover Footnotes up to, and including, 1.4
Timeline
- 2026-06-09: disclosed
- 2026-06-09: advisory
References
- https://plugins.trac.wordpress.org/browser/jquery-hover-footnotes/trunk/jqFootnotes.php
- https://plugins.trac.wordpress.org/browser/jquery-hover-footnotes/trunk/jqFootnotes.php
- https://plugins.trac.wordpress.org/browser/jquery-hover-footnotes/trunk/jqFootnotes.php
- https://plugins.trac.wordpress.org/browser/jquery-hover-footnotes/trunk/jqFootnotes.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/b02bdf2a-1d99-4cc3-8f75-822ff0792e44?source=cve