This vulnerability in the Footnotes for WordPress plugin by C. Johnson involves improper input sanitization that leads to stored cross-site scripting (XSS). An attacker could inject malicious scripts that are stored by the plugin and later executed in the context of users viewing affected pages. The issue affects all versions up to 2016.1230. The CVSS vector indicates network attack vector, low attack complexity, requiring privileges and user interaction, with impacts on confidentiality, integrity, and availability rated as low to low and low respectively. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation could allow an attacker with some privileges and requiring user interaction to execute arbitrary scripts in the context of affected users, potentially leading to information disclosure, modification of content, or denial of service. The impact is rated medium severity with low confidentiality, integrity, and availability impacts. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the affected plugin version. Applying strict input validation or web application firewall rules to detect and block malicious payloads may provide temporary mitigation.