CVE-2026-10553: jQuery Hover Footnotes CSRF & Stored XSS Vulnerability

Technical summary

CVE-2026-10553 is a Cross-Site Request Forgery (CSRF) vulnerability in jQuery Hover Footnotes versions up to 1.4 stemming from missing or inadequate nonce validation in the jqFootnotes_options_subpanel function. The vulnerability is dangerous because it can be chained with a Stored Cross-Site Scripting (XSS) flaw: when an attacker modifies plugin options such as jqfoot_anchor_open, jqfoot_anchor_close, and jqfoot_title via forged requests, these values are persisted without sanitization through update_option() and subsequently rendered unescaped on the frontend. This two-step exploitation results in persistent XSS affecting all site visitors, not just administrators.

Business impact

An attacker exploiting this vulnerability can deface or inject malicious content into every page served by a vulnerable WordPress site. The stored nature of the attack means the injected content persists until remediated. Site visitors may be redirected, have credentials harvested, or encounter malware. Site reputation damage, compliance violations (PCI-DSS, GDPR), and user trust erosion are material business risks. Because exploitation only requires tricking an administrator to click a link—a low bar—any site running the plugin remains at risk.

Affected systems

All versions of the jQuery Hover Footnotes plugin for WordPress up to and including version 1.4 are vulnerable. The vulnerability affects any WordPress site that has this plugin installed and activated, regardless of other security controls.

Exploitability

Exploitation is relatively straightforward and requires low technical skill. An attacker crafts a malicious link or embeds a forged request in a webpage, then tricks a site administrator into clicking it or visiting the attacker's page. No authentication is required from the attacker's perspective—only social engineering against the admin. The CVSS score of 4.3 (MEDIUM) reflects that while impact is limited to integrity (no confidentiality or availability loss), the attack vector is network-based and user interaction is required but not difficult to achieve.

Remediation

The plugin maintainers must release a patched version that implements proper nonce validation on the jqFootnotes_options_subpanel function and sanitizes all option values before storage and unescaping during output. Site administrators should immediately disable and remove the plugin if an update is not available, or update to a patched version as soon as released. If the plugin must remain in use, restrict administrative access to trusted users and educate admins about CSRF phishing tactics.

Patch guidance

Monitor the jQuery Hover Footnotes plugin repository and the WordPress plugin directory for security updates. Once a patched version is released, apply it immediately via the WordPress admin dashboard. Verify the patch addresses both the nonce validation gap and output escaping. If the developer does not release a patch in a reasonable timeframe, consider switching to an actively maintained alternative for footnote functionality. Always test patches in a staging environment before production deployment.

Detection guidance

Monitor WordPress plugin update logs and configuration change audits for unexpected modifications to jQuery Hover Footnotes settings. Check the wp_options table for suspicious values in jqfoot_anchor_open, jqfoot_anchor_close, and jqfoot_title fields. Review server access logs for POST requests to the plugin's admin handler that lack corresponding logged admin interactions. Look for admin session activity from unusual geographic locations or user agents. Web Application Firewall (WAF) rules can flag requests to the vulnerable function lacking valid nonce parameters. Front-end content monitoring tools can detect injected scripts in page source code.

Why prioritize this

While the CVSS score is MEDIUM (4.3), the real-world risk is elevated because the attack chain is simple to execute and the impact is persistent. Unlike many CSRF flaws that merely enable unauthorized configuration changes, this vulnerability directly leads to site-wide content injection. Any WordPress site running this plugin should prioritize patching or removal within days, not weeks. The requirement for admin interaction is a common vector in WordPress-targeted phishing campaigns.

Risk score, explained

CVSS 4.3 reflects a network-accessible vulnerability requiring user interaction (the admin clicking a link) with limited impact scope (integrity only, no confidentiality or availability impact). However, the severity is elevated in practice by the fact that the resulting XSS is stored and affects all site visitors, making this more damaging than a typical CSRF vulnerability. Organizations should treat this as higher priority than the base score alone suggests if the plugin is in use.

Frequently asked questions