Stored Cross-Site Scripting in Footnotes Made Easy Plugin for WordPress

CVE-2025-11733

What is CVE-2025-11733?

The Footnotes Made Easy plugin for WordPress suffers from a vulnerability that allows for Stored Cross-Site Scripting due to inadequate input sanitization and output escaping in its settings. This flaw enables unauthenticated attackers to inject malicious scripts, which can execute whenever users visit affected pages, potentially compromising user data and the integrity of the website. Ensuring plugins are updated and securely configured is critical to mitigating such risks.

References