CVE-2026-15383

MediumCVSS 6.1

Published: 03/08/2026(UTC)Updated: 26/08/2026(UTC)Translated: 03/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

7th percentile - higher than 7% of all known CVEs

Summary

The Blog Floating Button WordPress plugin through version 1.4.20 does not sanitize or escape the visitor User-Agent header, which it stores through an unauthenticated tracking REST endpoint and later renders unescaped in an administrator report page. This allows an unauthenticated attacker to store a malicious script that executes in the session of any administrator who views the access report, leading to site takeover.

Risk Assessment

An attacker can hijack an administrator's session, leading to full site compromise, including data theft and content modification.

Recommendation

Update the Blog Floating Button plugin to a version above 1.4.20 or apply a patch that sanitizes and escapes the User-Agent header before storage and display.

Other vulnerabilities in Blog Floating Button

CVE-2026-28170High
Blog Floating Button plugin versions up to 1.4.20 contain an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious script without authentication.

Original NVD description (English source)

The Blog Floating Button WordPress plugin through 1.4.20 does not sanitize or escape the visitor User-Agent header, which it stores through an unauthenticated tracking REST endpoint and later renders unescaped in an administrator report page. This allows an unauthenticated attacker to store a malicious script that executes in the session of any administrator who views the access report, leading to site takeover.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS