This vulnerability exists because the jqFootnotes_options_subpanel function does not enforce proper nonce validation. As a result, any unauthenticated user can send a crafted request that changes the plugin’s options. Because options such as jqfoot_anchor_open, jqfoot_anchor_close, and jqfoot_title are output directly into page content without escaping, the attacker can store malicious scripts that execute for all visitors.

The affected product is the jQuery Hover Footnotes WordPress plugin, all releases up to and including version 1.4. This includes installations that have not yet applied the latest patch or a newer version.

The CVSS score of 4.3 indicates moderate severity, and the lack of an EPSS score or KEV listing suggests no known mass exploitation at present. Exploitation requires that an administrator unknowingly performs a request that includes the forged parameters, so the attack vector is primarily social engineering of a privileged user. The impact is that any site visitor could receive injected JavaScript payloads, compromising confidentiality and integrity of the site’s front‑end.