CVE-2026-28170

HighCVSS 7.1

Published: 13/08/2026(UTC)Updated: 23/10/2026(UTC)Translated: 13/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

Blog Floating Button plugin versions up to 1.4.20 contain an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious script without authentication.

Risk Assessment

The risk includes execution of malicious script in the user's browser, potentially leading to data theft or session hijacking.

Recommendation

Update the plugin to a version newer than 1.4.20 that includes a fix for the XSS vulnerability.

Other vulnerabilities in Blog Floating Button

CVE-2026-15383Medium
The Blog Floating Button WordPress plugin through version 1.4.20 does not sanitize or escape the visitor User-Agent header, which it stores through an unauthenticated tracking REST endpoint and later renders unescaped in an administrator report page. This allows an unauthenticated attacker to store a malicious script that executes in the session of any administrator who views the access report, leading to site takeover.

Original NVD description (English source)

Unauthenticated Cross Site Scripting (XSS) in Blog Floating Button <= 1.4.20 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS