CVE-2025-15378: AJS Footnotes Plugin XSS Vulnerability

CVE-2025-15378 Overview

The AJS Footnotes plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability affecting all versions up to and including 1.0. The vulnerability exists in the note_list_class and popup_display_effect_in parameters due to missing authorization checks, absent nonce verification on settings save operations, and insufficient input sanitization combined with inadequate output escaping. This security flaw enables unauthenticated attackers to modify plugin settings and inject malicious JavaScript code into WordPress pages, which executes in the context of any user who visits an affected page.

Critical Impact

Unauthenticated attackers can inject persistent malicious scripts that execute in visitors' browsers, potentially leading to session hijacking, credential theft, defacement, or malware distribution through compromised WordPress sites.

Affected Products

• AJS Footnotes WordPress Plugin version 1.0 and earlier
• WordPress sites using vulnerable AJS Footnotes installations

Discovery Timeline

• 2026-01-14 - CVE-2025-15378 published to NVD
• 2026-01-14 - Last updated in NVD database

Technical Details for CVE-2025-15378

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability stems from a combination of security control failures in the AJS Footnotes plugin. The plugin fails to implement proper authorization checks when processing settings updates, allowing any user—including unauthenticated visitors—to modify plugin configuration. Additionally, the absence of nonce verification means there is no CSRF protection, and the lack of proper input sanitization and output escaping allows malicious JavaScript to be stored and later rendered to other users.

When an attacker exploits this vulnerability, malicious scripts become persistently embedded in the WordPress database and execute automatically whenever any user accesses a page containing footnote functionality. This differs from reflected XSS in that the payload persists across sessions and affects multiple victims without requiring individual targeting.

Root Cause

The root cause is a multi-layered failure in security controls within the plugin's settings handling mechanism (CWE-79). Specifically, the vulnerable code paths at lines 138, 271, and 303 in ajs_footnotes.php do not validate user authorization before processing settings updates, do not verify nonce tokens to prevent CSRF attacks, and fail to sanitize user input or escape output when rendering the note_list_class and popup_display_effect_in parameters.

Attack Vector

The attack is network-accessible and requires no authentication or user interaction from the attacker's perspective. An attacker can send a crafted HTTP request to the WordPress site targeting the plugin's settings endpoint with malicious JavaScript payloads in the vulnerable parameters. Because there are no authorization or nonce checks, the request is processed, and the malicious script is stored in the database.

The injected script then executes in the browser context of any subsequent visitor who views a page where the footnotes functionality renders the compromised settings. This enables attackers to perform actions such as stealing session cookies, capturing keystrokes, redirecting users to phishing sites, or injecting additional malicious content.

For technical details on the vulnerable code paths, see the WordPress Plugin Code Reference and the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-15378

Indicators of Compromise

• Unexpected JavaScript code present in AJS Footnotes plugin settings, particularly in note_list_class or popup_display_effect_in fields
• Suspicious <script> tags or event handler attributes (e.g., onerror, onload) in plugin configuration values
• Unauthorized modification of plugin settings without corresponding admin activity logs
• Reports from users experiencing unexpected browser behavior or redirects on pages with footnotes

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block XSS payloads in HTTP requests targeting WordPress plugin endpoints
• Monitor WordPress database for unauthorized changes to the wp_options table entries related to AJS Footnotes settings
• Deploy Content Security Policy (CSP) headers to detect and report inline script execution attempts
• Use security scanning tools to identify stored XSS payloads in plugin configuration data

Monitoring Recommendations

• Enable detailed access logging on WordPress installations to track requests to plugin settings endpoints
• Configure alerting for unauthorized settings modifications, especially from unauthenticated sources
• Regularly audit plugin settings for suspicious content or unexpected JavaScript code
• Monitor browser console errors and CSP violation reports that may indicate XSS exploitation attempts

How to Mitigate CVE-2025-15378

Immediate Actions Required

• Deactivate and remove the AJS Footnotes plugin immediately if running version 1.0 or earlier
• Audit current plugin settings for any injected malicious code and remove suspicious entries
• Review server access logs for evidence of exploitation attempts against the vulnerable endpoints
• Consider implementing a WAF rule to block malicious requests targeting AJS Footnotes endpoints until a patch is available

Patch Information

At the time of publication, no patched version has been confirmed. Website administrators should monitor the official WordPress plugin repository and the Wordfence Vulnerability Report for updates regarding a security fix. Until a patch is released, the plugin should be disabled on production sites.

Workarounds

• Completely disable or uninstall the AJS Footnotes plugin until a security update is available
• Implement server-level access controls to restrict requests to the plugin's settings endpoints
• Deploy a Web Application Firewall with XSS detection rules to filter malicious input
• Use an alternative footnotes solution that has been security audited

# WordPress CLI commands to disable the vulnerable plugin
wp plugin deactivate ajs-footnotes --path=/var/www/html/wordpress
wp plugin delete ajs-footnotes --path=/var/www/html/wordpress

# Verify plugin removal
wp plugin list --path=/var/www/html/wordpress | grep -i footnotes