The Modern Footnotes plugin fails to properly escape user input before rendering it in web pages, allowing an attacker to store malicious scripts that execute when visitors view affected content. This stored XSS can lead to session hijacking, data theft, or defacement of the site, compromising the confidentiality, integrity, and availability of the WordPress installation.

WordPress sites using the PrismTechStudios Modern Footnotes plugin with any version up to and including 1.4.19 are affected. No other products or versions are listed as vulnerable.

The CVSS score of 6.5 indicates a moderate severity, while the EPSS score of < 1% suggests a low probability that the flaw will be actively exploited in the wild. The vulnerability is not current in the CISA KEV catalog. The likely attack path involves an attacker inserting malicious code into a field handled by Modern Footnotes, which is then stored and served to arbitrary visitors; this requires that the attacker can submit or edit content that is processed by the plugin, which is inferred from the stored‐XSS description.