EUVD-2026-52174
GHSA-r7c9-cm4j-g8qq
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Unauthenticated network REST endpoint (AV:N/PR:N/AC:L); stored payload fires only on admin page visit (UI:R); XSS crosses into admin browser context (S:C); session hijack yields partial C/I with no availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The Blog Floating Button WordPress plugin through 1.4.20 does not sanitize or escape the visitor User-Agent header, which it stores through an unauthenticated tracking REST endpoint and later renders unescaped in an administrator report page. This allows an unauthenticated attacker to store a malicious script that executes in the session of any administrator who views the access report, leading to site takeover.
AnalysisAI
Stored cross-site scripting in the Blog Floating Button WordPress plugin (≤1.4.20) allows unauthenticated attackers to inject malicious JavaScript via the HTTP User-Agent header into the plugin's visitor tracking REST endpoint. The payload persists in the database and executes in the browser session of any administrator who opens the plugin's access report page, enabling full site takeover through the hijacked admin session. A publicly available proof-of-concept from WPScan confirms the attack path; no vendor-released patch has been identified at time of analysis.
Technical ContextAI
The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting), specifically the stored/persistent variant. The plugin exposes a REST endpoint that accepts unauthenticated HTTP requests and logs visitor metadata - including the raw User-Agent header - to the WordPress database without applying sanitization (input filtering) or escaping (output encoding). When the stored log entries are later rendered in the admin-facing access report page, the absence of wp_kses or esc_html-equivalent output escaping causes the browser to interpret injected markup as executable script. The affected codebase is identified by CPE cpe:2.3:a:unknown:blog_floating_button:*:*:*:*:*:*:*:*, covering all releases through 1.4.20. Because WordPress REST API endpoints are publicly reachable by design, the ingestion path requires no credentials, making the injection surface trivially accessible to any network-connected actor.
RemediationAI
No vendor-released patch has been identified at time of analysis - the CPE vendor field is listed as 'unknown' and no fixed version appears in any available reference. The primary recommended action is immediate deactivation and removal of the Blog Floating Button plugin from all WordPress installations running version 1.4.20 or earlier. As a compensating control while awaiting a vendor fix, administrators should restrict access to the WordPress admin panel (/wp-admin/) using IP allowlisting at the web server or WAF layer, which prevents the stored payload from executing even if injection has already occurred - note this does not remove existing stored payloads. Administrators should also audit the plugin's stored access log data for suspicious User-Agent strings and purge any suspect entries from the database directly. The plugin's unauthenticated REST endpoint should be blocked at the WAF or network perimeter if plugin deactivation is not immediately feasible, though this may break plugin functionality. Monitor the WPScan advisory (https://wpscan.com/vulnerability/45e5d74e-6f7b-499b-ae25-74fe1bc8d18d/) and the WordPress plugin repository for a patched release.
More in Blog Floating Button
View allCross-Site Request Forgery (CSRF) vulnerability in Meril Inc. Rated high severity (CVSS 8.8), this vulnerability is remo
Unauthenticated reflected or stored XSS in the Blog Floating Button WordPress plugin (versions 1.4.20 and earlier) allow
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today