Blog Floating Button
Monthly
Unauthenticated reflected or stored XSS in the Blog Floating Button WordPress plugin (versions 1.4.20 and earlier) allows remote, unauthenticated attackers to inject arbitrary JavaScript into pages viewed by authenticated users. The vulnerability carries a CVSS 3.1 score of 7.1 with scope change (S:C), meaning malicious script executes in the victim browser's context outside the plugin's own scope, enabling session hijacking, credential theft, or admin account takeover. No public exploit code or CISA KEV listing has been identified at the time of analysis, but the unauthenticated attack vector lowers the bar for opportunistic exploitation across the large WordPress ecosystem.
Stored cross-site scripting in the Blog Floating Button WordPress plugin (≤1.4.20) allows unauthenticated attackers to inject malicious JavaScript via the HTTP User-Agent header into the plugin's visitor tracking REST endpoint. The payload persists in the database and executes in the browser session of any administrator who opens the plugin's access report page, enabling full site takeover through the hijacked admin session. A publicly available proof-of-concept from WPScan confirms the attack path; no vendor-released patch has been identified at time of analysis.
Cross-Site Request Forgery (CSRF) vulnerability in Meril Inc. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Unauthenticated reflected or stored XSS in the Blog Floating Button WordPress plugin (versions 1.4.20 and earlier) allows remote, unauthenticated attackers to inject arbitrary JavaScript into pages viewed by authenticated users. The vulnerability carries a CVSS 3.1 score of 7.1 with scope change (S:C), meaning malicious script executes in the victim browser's context outside the plugin's own scope, enabling session hijacking, credential theft, or admin account takeover. No public exploit code or CISA KEV listing has been identified at the time of analysis, but the unauthenticated attack vector lowers the bar for opportunistic exploitation across the large WordPress ecosystem.
Stored cross-site scripting in the Blog Floating Button WordPress plugin (≤1.4.20) allows unauthenticated attackers to inject malicious JavaScript via the HTTP User-Agent header into the plugin's visitor tracking REST endpoint. The payload persists in the database and executes in the browser session of any administrator who opens the plugin's access report page, enabling full site takeover through the hijacked admin session. A publicly available proof-of-concept from WPScan confirms the attack path; no vendor-released patch has been identified at time of analysis.
Cross-Site Request Forgery (CSRF) vulnerability in Meril Inc. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.