CVE-2026-10553 describes a CSRF vulnerability in the jQuery Hover Footnotes WordPress plugin (<=1.4) caused by missing or incorrect nonce validation on the jqFootnotes_options_subpanel function. This allows unauthenticated attackers to modify plugin options such as jqfoot_anchor_open, jqfoot_anchor_close, and jqfoot_title via a forged request. These options are stored without sanitization and rendered unescaped on the frontend, enabling a chained persistent XSS attack that affects all site visitors if an administrator is tricked into triggering the CSRF.

An attacker can exploit the CSRF vulnerability to change plugin settings with arbitrary values, which are then stored and rendered unescaped on the site frontend. This can lead to persistent Cross-Site Scripting attacks impacting all visitors, potentially allowing injection of malicious scripts. The vulnerability requires tricking an administrator into performing an action such as clicking a crafted link. There is no direct confidentiality or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a patch is available, site administrators should avoid clicking untrusted links that could trigger the CSRF. Monitoring for plugin updates or vendor advisories is recommended to apply any forthcoming official fixes.