jQuery Hover Footnotes Plugin for WordPress Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the jQuery Hover Footnotes plugin for WordPress, affecting all versions through 1.4. The vulnerability arises from inadequate nonce validation in the 'jqFootnotes_options_subpanel' function, allowing unauthenticated attackers to manipulate the plugin's settings with arbitrary values. These option values, including 'jqfoot_anchor_open', 'jqfoot_anchor_close', and 'jqfoot_title', are output unescaped into the frontend, creating a pathway for persistent Cross-Site Scripting (XSS) that impacts all site visitors. Exploitation of this CSRF vulnerability can lead to stored XSS, as the modified option values are saved without proper sanitization and displayed unescaped on the site.

Impact

Exploitation of this vulnerability allows for Cross-Site Request Forgery, with the potential to introduce Cross-Site Scripting vulnerabilities that are stored and affect all site visitors.