CVE-2025-15378 is a stored cross-site scripting vulnerability in the AJS Footnotes WordPress plugin up to version 1.0. The issue stems from a lack of authorization and nonce verification during settings updates, allowing unauthenticated attackers to change plugin settings via the 'note_list_class' and 'popup_display_effect_in' parameters. Additionally, the plugin fails to properly sanitize and escape these inputs before outputting them in web pages. This enables injection of arbitrary scripts that execute in the context of any user visiting the compromised pages. The vulnerability is remotely exploitable without privileges or user interaction, with a CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N). No patch or vendor advisory is currently available.

An unauthenticated attacker can exploit this vulnerability to inject and execute arbitrary JavaScript in the context of users visiting pages where the plugin outputs the manipulated settings. This can lead to partial confidentiality and integrity loss (e.g., theft of cookies or session tokens, defacement, or other malicious actions performed on behalf of users). Availability is not impacted. The vulnerability affects all users of the plugin version 1.0 and earlier.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling or removing the AJS Footnotes plugin to prevent exploitation. Monitoring for plugin updates or official advisories from the vendor is recommended.