CVE-2026-10738 is a stored cross-site scripting vulnerability in the jQuery Hover Footnotes WordPress plugin (versions >=0 and <1.5). The issue stems from improper neutralization of input during web page generation, specifically in the Footnote Qualifier syntax '{{...}}'. Authenticated attackers with author-level privileges or above can inject arbitrary JavaScript payloads that execute in the context of users viewing the compromised pages. The vulnerability bypasses WordPress's wp_kses_post() filtering because the payload uses attribute-breakout techniques without angle brackets, which are not sanitized by the core filtering mechanism.

Successful exploitation allows authenticated users with author-level access or higher to inject and execute arbitrary scripts in the browsers of users who visit the affected pages. This can lead to information disclosure, session hijacking, or other client-side impacts. The vulnerability does not affect availability and requires authentication with elevated privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict author-level access to trusted users only and consider disabling or removing the jQuery Hover Footnotes plugin if possible. Monitor vendor channels for updates or patches addressing this vulnerability.