CVE-2026-10738: jQuery Hover Footnotes Plugin XSS Flaw

CVE-2026-10738 Overview

CVE-2026-10738 is a stored Cross-Site Scripting (XSS) vulnerability in the jQuery Hover Footnotes plugin for WordPress, affecting all versions up to and including 1.4. The flaw resides in the Footnote Qualifier parameter, which uses {{...}} syntax and fails to properly sanitize input or escape output. Authenticated attackers with author-level access or above can inject arbitrary JavaScript into pages, which executes when other users view the affected content. The vulnerability is tracked as [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Authenticated authors can persist JavaScript payloads that execute in the browsers of site visitors and administrators, enabling session theft, content modification, and privilege escalation through administrator interaction.

Affected Products

WordPress jQuery Hover Footnotes plugin, versions ≤ 1.4
WordPress sites with author-level user registration enabled and the plugin active
Multi-author WordPress deployments using the plugin for footnote rendering

Discovery Timeline

2026-06-09 - CVE-2026-10738 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-10738

Vulnerability Analysis

The jQuery Hover Footnotes plugin renders footnote markup using a custom {{...}} placeholder syntax processed by jqFootnotes.php. User-supplied content within the Footnote Qualifier is interpolated directly into HTML attribute contexts without proper escaping. Because the injection point sits inside an HTML attribute, attackers craft payloads that break out of the attribute by closing the quote and appending an event handler such as onmouseover or onfocus.

The payload contains no angle brackets (< or >), which allows it to bypass WordPress core's wp_kses_post() filtering. The wp_kses_post() function evaluates allowed tags and attribute lists for HTML element contexts but does not sanitize content already destined for attribute values that lack proper context-aware escaping. This gap turns a tag-stripping filter into an insufficient defense against attribute-breakout XSS.

Root Cause

The root cause is missing context-aware output escaping at the points where footnote qualifier data is concatenated into HTML attributes inside jqFootnotes.php (lines 213, 222, 235, and 246). The plugin relies on wp_kses_post(), which sanitizes element-level HTML but does not apply esc_attr() or equivalent attribute-context escaping. Stored input retains its raw quotes and event-handler tokens through to the rendered page.

Attack Vector

An attacker authenticated as an author or higher creates or edits a post containing a footnote with a malicious qualifier value. The qualifier includes a double-quote character followed by an HTML event handler and arbitrary JavaScript. When any user, including administrators, views the published page, the browser parses the broken-out attribute and executes the injected script in the context of the WordPress site.

The vulnerability is exploitable over the network and requires no user interaction beyond visiting an affected page. Source code references are available in the WordPress plugin trac and the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-10738

Indicators of Compromise

Post or page content containing unexpected double-quote sequences followed by on* event handler attributes inside footnote shortcodes or {{...}} qualifier blocks
Database rows in wp_posts with footnote markup containing JavaScript tokens such as javascript:, onerror=, onmouseover=, or onload=
New or modified administrator accounts created shortly after an author-level user edited content
Unexpected outbound requests from administrator browsers to attacker-controlled domains after viewing posts authored by lower-privileged users

Detection Strategies

Audit all posts and pages authored by author-level accounts for the presence of footnote qualifier syntax and inspect for attribute-breakout patterns
Run a database query against wp_posts.post_content for the regular expression \{\{[^}]*["'][^}]*on[a-z]+= to surface suspicious entries
Monitor web server access logs for requests returning pages with injected payloads and correlate with administrator session activity

Monitoring Recommendations

Enable a Web Application Firewall (WAF) rule set that detects HTML attribute-breakout patterns in WordPress POST requests to wp-admin/post.php
Track WordPress user role changes and new administrator account creation as high-priority events
Log and review all plugin and theme file modifications to detect post-exploitation persistence

How to Mitigate CVE-2026-10738

Immediate Actions Required

Deactivate the jQuery Hover Footnotes plugin until a patched release is available, as version 1.4 and earlier remain vulnerable
Restrict author-level and above account creation, and review the membership of these roles for unauthorized users
Scan all existing posts and pages for footnote markup containing event handlers or quote-breakout sequences and remove malicious content

Patch Information

No patched version of the jQuery Hover Footnotes plugin was identified in the published advisory at the time of CVE assignment. Site operators should monitor the Wordfence advisory and the WordPress plugin repository for an update. A proper fix requires the plugin to apply esc_attr() to qualifier values before rendering them into HTML attributes.

Workarounds

Replace the plugin with an actively maintained footnote alternative that performs context-aware escaping
Apply a WAF virtual patch that blocks footnote qualifier inputs containing quote characters followed by on[a-z]+= event handlers
Reduce the privilege of untrusted contributors from Author to Contributor, since Contributor posts require Editor approval before publishing

bash

# Disable the vulnerable plugin via WP-CLI
wp plugin deactivate jquery-hover-footnotes

# Audit posts for suspicious footnote payloads
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content REGEXP '\\{\\{[^}]*[\"\\'][^}]*on[a-z]+='"