Authenticated (Author) Stored XSS in jQuery Hover Footnotes (≤ 1.4) — Risk, Detection, and Mitigation from a Hong Kong Security Expert

Author: WP‑Firewall Security Team  |  Date: 2026-06-09

TL;DR — A stored Cross‑Site Scripting (XSS) vulnerability affecting the jQuery Hover Footnotes WordPress plugin (versions ≤ 1.4; CVE‑2026‑10738) allows an authenticated user with Author privileges to inject HTML/JS that may be stored and executed when visitors view pages. There is no official patch at the time of this advisory. This article explains the risk, realistic attack chains, detection techniques, hardening and developer fixes, WAF/virtual‑patch examples, incident response, and recommended next steps for site owners and developers.

Background and high‑level summary

A stored XSS vulnerability was reported in the jQuery Hover Footnotes plugin for WordPress (vulnerable versions ≤ 1.4). The vulnerability allows an authenticated user with the Author role to inject HTML/JavaScript into data stored by the plugin. That stored content can later be served to site visitors without proper escaping or sanitization, leading to script execution in the context of a victim’s browser.

• Vulnerable plugin: jQuery Hover Footnotes
• Vulnerable versions: ≤ 1.4
• CVE: CVE‑2026‑10738
• Severity (observed): CVSS 5.9 (medium/low depending on context)
• Required privilege: Author
• Exploitation: Stored XSS — user interaction required (attacker needs an Author account or a privileged user to perform an action like clicking a crafted link or otherwise interacting)

Why this matters: stored XSS allows attackers to execute arbitrary JavaScript in the context of site visitors. Even if the initial attacker only has an Author account (not administrator), persistent XSS can be leveraged for account takeover, content defacement, cookie theft (if cookies are not HttpOnly), privilege escalation chains, or distribution of malicious redirects or phishing content. Sites with user registrations that allow authorship (guest posts, multi-author blogs) are especially exposed.

Realistic attack scenarios

1. Malicious author creates a footnote containing a script payload (e.g., ) or an HTML attribute payload (onmouseover/onload) in the footnote content area. When a visitor views any page where the footnote is rendered, the browser executes the script.
2. An attacker with a lower privilege gets an Author to visit a crafted page that uses a DOM XSS or reflected vector to submit malicious content into the plugin’s storage. The payload is stored and later executed for visitors.
3. Stored XSS used for persistent attacks: once injected, the payload can add a backdoor JS, exfiltrate sensitive tokens, or create a stealthy redirect to a fake login or ad network.

Important context: The Author role can publish content and create posts — many sites allow guest authors (contributors promoted to author), editorial staff, or users with elevated roles. If your site allows Author accounts beyond fully trusted admins, the risk increases.

How exploitable is it?

• Exploitability depends on whether an attacker can obtain an Author account or trick an existing Author into performing an action.
• CVSS and technical details suggest this is not a remote unauthenticated RCE; it is an authenticated stored XSS. Still, stored XSS is a common and effective vector for widespread malware delivery.
• Many real-world attacks rely on social engineering to get an editor or author to paste content or click a link. Because exploitation can be fully automated once stored (visitors are affected without any further interaction), impacted sites are at real risk.

Immediate actions for site owners (first 24 hours)

1. Identify whether your site uses the plugin:
   • WordPress admin: Plugins → Installed Plugins → Look for “jQuery Hover Footnotes”.
   • WP‑CLI: wp plugin list | grep hover
2. If present and version ≤ 1.4, act immediately:
   • Disable the plugin immediately if you cannot apply a vendor patch (there may be no official patch yet).
   • If disabling the plugin is not feasible (site needs footnote functionality), consider temporarily restricting pages that render footnotes to authenticated users only.
3. Review Author accounts:
   • Audit authors currently registered. Remove unused or suspicious Author accounts.
   • Enforce strong passwords and enable multi‑factor authentication (MFA) for author/editor roles.
4. Scan for malicious content:

   Search the database for suspicious tags in post content and plugin meta. Quick SQL to find script tags in posts/postmeta (run in a read‑only environment first):

   -- Search wp_posts for script tags
   SELECT ID, post_title, post_type
   FROM wp_posts
   WHERE post_content LIKE '%

5. Review access logs:
   • Look for suspicious POSTs, admin‑ajax calls, or unusual admin page requests.
6. If you find malicious content, isolate (take offline) and follow cleanup guidance below.

-- Find footnote-related meta that includes HTML
SELECT post_id, meta_key
FROM wp_postmeta
WHERE meta_key LIKE '%footnote%' AND meta_value REGEXP '<(script|img|iframe|svg)';

-- Find any content with script tags or event attributes
SELECT ID, post_title
FROM wp_posts
WHERE post_content REGEXP '

 &$attrs ) {
    if ( is_array( $attrs ) ) {
        $attrs = array_diff( $attrs, array_filter( $attrs, function( $a ) { return strpos( $a, 'on' ) === 0; } ) );
    }
}
$clean = wp_kses( $_POST['footnote_content'], $allowed_tags );
update_post_meta( $post_id, 'jquery_hover_footnote', $clean );
?>

 array( 'href' => true, 'title' => true, 'rel' => true ),
        'strong' => array(),
        'em' => array(),
        'b' => array(),
        'i' => array(),
        'br' => array(),
        'p' => array(),
        'ul' => array(),
        'ol' => array(),
        'li' => array(),
        'span' => array( 'class' => true ),
    );
    // Strip dangerous attributes like onerror/onload
    return wp_kses( $content, $allowed );
}

add_action( 'save_post', function( $post_id, $post, $update ) {
    if ( defined( 'DOING_AUTOSAVE' ) && DOING_AUTOSAVE ) return;
    if ( ! current_user_can( 'edit_post', $post_id ) ) return;
    if ( isset( $_POST['jquery_hover_footnote'] ) ) {
        $clean = hk_sanitize_footnote_content( $_POST['jquery_hover_footnote'] );
        update_post_meta( $post_id, 'jquery_hover_footnote', $clean );
    }
}, 10, 3 );
?>

# Block POSTs that include 
			
				
			
					

							
			
			
			





		

		
					
				 
 
   
 
  
 
 Review My Order
 0 
 
 
  
 
 
  
 
 
 
 Subtotal
 
Taxes & shipping calculated at checkout
 
 
  
 
 
 
   Checkout