The AJS Footnotes plugin for WordPress contains a stored cross‑site scripting flaw that allows an unauthenticated user to modify the "note_list_class" and "popup_display_effect_in" settings via the settings form. Because the plugin bypasses authorization checks, omits nonce validation, and fails to sanitize or escape these parameters, the malicious input is persisted in the database and later rendered on any page that includes the settings. This results in arbitrary JavaScript execution in the browsers of all site visitors who load an affected page.

All installations of the AJS Footnotes plugin with version 1.0 or earlier, regardless of the WordPress core version, are vulnerable.

The CVSS score of 7.2 indicates moderate‑to‑high severity, while the EPSS score of less than 1 percent suggests that widespread exploitation is unlikely at present. The flaw is not listed in the CISA KEV catalog. An attacker can exploit the vulnerability by sending unauthenticated POST requests that modify the plugin settings, causing the injected script to be served to any visitor. Inferred from typical XSS outcomes, the payload could be used to deface the site, steal session cookies, or launch other client‑side attacks, though these consequences are not explicitly documented in the description.