The jQuery Hover Footnotes plugin for WordPress stores footnote qualifiers supplied by authenticated users with author level or higher. The plugin renders these qualifiers without proper sanitization or escaping, and the injected payload uses a '{{…}}' syntax that omits angle brackets. This bypasses WordPress core’s wp_kses_post() filtering, which only removes disallowed tags. Consequently, arbitrary JavaScript can be persisted and executed in the context of any visitor who views a page containing the modified footnote.

WordPress sites that have installed the jQuery Hover Footnotes plugin version 1.4 or earlier. Any site with users who possess author or higher privileges that can edit posts or pages is at risk.

The CVSS score of 6.4 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated author‑level access or higher; once an attacker can place a footnote qualifier, the stored JavaScript will execute for all users who view the affected page. The attack path is straightforward after privilege is attained and does not require additional setup.