CVE-2026-10738 describes a stored cross-site scripting vulnerability in the jQuery Hover Footnotes WordPress plugin (versions up to 1.4). The issue is due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of the Footnote Qualifier syntax '{{...}}'. Authenticated attackers with author-level privileges can inject scripts that execute in the context of other users viewing the pages. The attack payload uses attribute-breakout techniques that evade WordPress's wp_kses_post() filtering, which only removes disallowed HTML tags but does not sanitize attribute values, allowing script injection without angle brackets.

Successful exploitation allows an attacker with author-level access to inject arbitrary JavaScript into pages rendered by the plugin. This can lead to session hijacking, privilege escalation, or other malicious actions executed in the context of users viewing the compromised pages. The vulnerability does not affect availability but impacts confidentiality and integrity. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor the vendor's communications for updates. Until a patch is available, restrict author-level access to trusted users only and consider disabling or removing the plugin if possible to prevent exploitation.