CVE-2026-10738: jQuery Hover Footnotes Plugin Stored XSS Vulnerability

Technical summary

CVE-2026-10738 is a Stored Cross-Site Scripting (XSS) vulnerability in jQuery Hover Footnotes versions up to and including 1.4. The plugin uses a double-brace syntax ('{{...}}') to denote footnote qualifiers, but fails to sanitize this input before database storage. The attack vector exploits attribute-context breakout payloads—typically a double-quote followed by an event handler—which contain no angle brackets and therefore pass through WordPress's wp_kses_post() filter, which is designed to strip disallowed tags but does not validate attribute content. Once stored, the payload executes in the context of any user viewing the page.

Business impact

A compromised WordPress site using this plugin can serve malicious content to all visitors without additional user interaction. An author-level attacker could deface pages, steal session tokens or cookies from readers, redirect visitors to malicious sites, or harvest credentials. The impact scales with site traffic and user privilege levels of readers. For sites where authors are third-party contributors or freelancers, this represents a significant supply-chain or content-management risk.

Affected systems

All WordPress installations using the jQuery Hover Footnotes plugin in version 1.4 or earlier are affected. The vulnerability requires the attacker to have author-level (or higher) permissions, which typically includes Contributors, Authors, Editors, and Administrators. The attack executes in all user browsers that access an injected page.

Exploitability

Exploitability is straightforward for authenticated users with author or higher privilege. The attack requires no special tools or user interaction from victims—it is automatically triggered when a page containing the malicious footnote is viewed. No network-specific conditions or unusual software configurations are required. However, the attacker must first gain or already possess author-level access, which acts as a practical barrier in many WordPress environments.

Remediation

Update jQuery Hover Footnotes to a version newer than 1.4 (verify the specific patched version against the plugin's official repository or vendor advisory). If an update is not immediately available, disable or deactivate the plugin. For sites where author accounts may be compromised, audit recent page and post edits for suspicious footnote syntax and remove any anomalous content.

Patch guidance

Check the WordPress Plugin Directory or the plugin vendor's site for version 1.5 or later, which should include input sanitization and output escaping fixes. Apply the update to all WordPress installations running this plugin. Before updating, back up your WordPress database and theme customizations. After patching, verify that existing footnotes render correctly and that no stored malicious payloads remain in the database.

Detection guidance

Search your WordPress database (wp_posts table) for footnote content containing attribute-breakout patterns, particularly double-quotes followed by event handlers (onload=, onerror=, onclick=, etc.) within the {{...}} syntax. Review the post_modified_gmt timestamps and post_modified_by user IDs for any suspicious edits by author-level accounts. Monitor web server logs for unusual script execution or console errors on pages using the plugin. Consider enabling WordPress security logging to track edits to posts containing this plugin's syntax.

Why prioritize this

Although the CVSS score is MEDIUM (6.4) and the vulnerability is not listed as actively exploited in KEV, Stored XSS in a page-rendering context poses direct risk to all site visitors. The relatively low barrier to exploitation for existing authors and the lack of a patched version availability at time of publication warrant timely action. Prioritize if author accounts are managed by external contributors, if your site has high traffic, or if reader accounts hold sensitive privileges.

Risk score, explained

CVSS 3.1 score of 6.4 (MEDIUM) reflects: Network-based attack vector (AV:N), low attack complexity (AC:L), and requirement for low privileges—specifically author-level access (PR:L). The impact is limited in scope (S:C, confidentiality and integrity only, no availability impact). The score does not account for the fact that Stored XSS is often treated more severely in practice than reflected in CVSS; security teams should consider contextual factors such as site criticality and user demographics when prioritizing.

Frequently asked questions