PT-2026-47637 · Weaverlancegmailcom · Jquery Hover Footnotes

Nishida Azuka · Published 2026-06-09 · Updated 2026-06-09 · CVE-2026-10553

NVD

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

The jQuery Hover Footnotes plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4. This is due to missing or incorrect nonce validation on the jqFootnotes options subpanel function. This makes it possible for unauthenticated attackers to update the plugin's settings with arbitrary values that, because option values such as jqfoot anchor open, jqfoot anchor close, and jqfoot title are echoed unescaped into frontend page content, can be chained into persistent Cross-Site Scripting affecting all site visitors via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Successful exploitation of the CSRF vulnerability can be chained into stored Cross-Site Scripting, as the overwritten option values are persisted via update option() without sanitization and rendered unescaped on the frontend.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-10553

Affected Products

Jquery Hover Footnotes

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-10553 · Security Note
• https://plugins.trac.wordpress.org/browser/jquery-hover-footnotes/trunk/jqFootnotes.php#L56 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/c174887b-e24d-4100-97da-8e0923ebafe5?source=cve · Note
• https://plugins.trac.wordpress.org/browser/jquery-hover-footnotes/trunk/jqFootnotes.php#L57 · Note
• https://plugins.trac.wordpress.org/browser/jquery-hover-footnotes/trunk/jqFootnotes.php#L159 · Note