CVE-2026-10553

The jQuery Hover Footnotes plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4. This is due to missing or incorrect nonce validation on the jqFootnotes_options_subpanel function. This makes it possible for unauthenticated attackers to update the plugin's settings with arbitrary values that, because option values such as jqfoot_anchor_open, jqfoot_anchor_close, and jqfoot_title are echoed unescaped into frontend page content, can be chained into persistent Cross-Site Scripting affecting all site visitors via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Successful exploitation of the CSRF vulnerability can be chained into stored Cross-Site Scripting, as the overwritten option values are persisted via update_option() without sanitization and rendered unescaped on the frontend.

• CWE-352

• https://plugins.trac.wordpress.org/browser/jquery-hover-footnotes/trunk/jqFootnotes.php#L159
• https://plugins.trac.wordpress.org/browser/jquery-hover-footnotes/trunk/jqFootnotes.php#L56
• https://plugins.trac.wordpress.org/browser/jquery-hover-footnotes/trunk/jqFootnotes.php#L57
• https://www.wordfence.com/threat-intel/vulnerabilities/id/c174887b-e24d-4100-97da-8e0923ebafe5?source=cve

Published

Jun 9, 2026

Last Modified

Jul 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-10548A security flaw has been discovered in NousResearch hermes-a…5.3
• CVE-2026-10549LDAP filter injection vulnerability in Yandex Database prior…5.3
• CVE-2026-1055The TalkJS plugin for WordPress is vulnerable to Stored Cros…4.4
• CVE-2026-10550A weakness has been identified in elunez eladmin up to 2.7. …6.3
• CVE-2026-10551The Breeze Cache WordPress plugin before 2.5.6 is vulnerable…6.1
• CVE-2026-10552The Blue Captcha plugin for WordPress is vulnerable to Cross…4.3
• CVE-2026-10557The Yarbo Android and iOS applications contain hard-coded MQ…9.8
• CVE-2026-10558A vulnerability was detected in SourceCodester Pizzafy Ecomm…6.3
• CVE-2026-10559A flaw has been found in SourceCodester Pizzafy Ecommerce Sy…6.3
• CVE-2026-1056The Snow Monkey Forms plugin for WordPress is vulnerable to …9.8
• CVE-2026-10560IBM Langflow OSS 1.0.0 through 1.9.6 contains a missing auth…9.1
• CVE-2026-10561IBM Langflow OSS 1.0.0 through 1.9.3 has an vulnerability du…10