The Footnotes Made Easy plugin for WordPress contains insufficient input sanitization and output escaping in its settings editor. A user who is not authenticated can submit arbitrary scripts that are stored and later rendered in the plugin output. When a visitor loads a page with the injected content, the browser executes the malicious script in the context of the site, allowing the attacker to hijack sessions, deface content, or perform other client‑side attacks. This vulnerability is classified as CWE‑79.

All installations of the Footnotes Made Easy plugin with a version of 3.0.7 or earlier are vulnerable. The affected vendor is Lumiblog and the product is the Footnotes Made Easy WordPress plugin.

The community CVSS score of 7.2 indicates a high severity, while the EPSS score of less than 1% suggests a very low probability of exploitation at the present time. The vulnerability is not currently listed in the CISA KEV catalog. Since the flaw allows unauthenticated users to inject scripts, the attack vector is likely through any user with access to the plugin settings interface. Even though exploitation requires input into the settings, the impact remains significant due to the ability to affect all site visitors.