CVE-2025-15378
Published: 14 January 2026
Summary
CVE-2025-15378 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 19.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-15378 is a stored cross-site scripting (XSS) vulnerability, classified under CWE-79, in the AJS Footnotes plugin for WordPress. It affects all versions up to and including 1.0. The issue stems from missing authorization and nonce verification during settings saves, along with insufficient input sanitization and output escaping for the 'note_list_class' and 'popup_display_effect_in' parameters. Published on 2026-01-14, it carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N).
Unauthenticated attackers can exploit this vulnerability remotely with low attack complexity and no privileges or user interaction required. By submitting malicious payloads via the vulnerable parameters, they can update plugin settings, injecting arbitrary web scripts into pages. These scripts execute in the context of any user's browser when accessing an affected page that utilizes the plugin's footnotes.
Advisories and references, including the Wordfence threat intelligence report and the plugin's source code on WordPress Trac (highlighting lines 138, 271, and 303 in ajs_footnotes.php version 1.0), provide details on the vulnerability but do not specify patches or mitigations in the available information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2546
Vulnerability details
The AJS Footnotes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'note_list_class' and 'popup_display_effect_in' parameters in all versions up to, and including, 1.0 due to missing authorization and nonce verification on settings save, as well as insufficient…
more
input sanitization and output escaping. This makes it possible for unauthenticated attackers to update plugin settings and inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored XSS in public-facing WordPress plugin directly enables remote exploitation of the web application without authentication.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces authorization checks and nonce validation on plugin settings updates, directly blocking the unauthenticated modification vector used to inject XSS payloads.
Requires validation of the 'note_list_class' and 'popup_display_effect_in' inputs before they are persisted, preventing malicious script content from being stored.
Mandates output filtering/escaping of stored footnote settings before rendering, neutralizing any injected scripts that reach the page.