weaverlancegmailcom vulnerabilities and threats

The jQuery Hover Footnotes WordPress plugin versions up to and including 1.4 contain a Cross-Site Request Forgery (CSRF) vulnerability due to missing or incorrect nonce validation. This flaw allows unauthenticated attackers to update plugin settings with arbitrary values via a forged request. Because these settings are output unescaped on the frontend, successful exploitation can lead to persistent Cross-Site Scripting (XSS) affecting all site visitors if an administrator is tricked into performing an action like clicking a malicious link.

The jQuery Hover Footnotes plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 1.4. This vulnerability arises from insufficient input sanitization and output escaping of the Footnote Qualifier syntax ('{{...}}'). Authenticated users with author-level access or higher can inject malicious scripts that execute when other users view the affected pages. The attack bypasses WordPress's standard HTML tag filtering by exploiting attribute contexts without angle brackets.