CVE-2026-28170

HighCVSS 7.1

Published: 13/08/2026(UTC)Updated: 14/08/2026(UTC)Translated: 13/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

8th percentile - higher than 8% of all known CVEs

Summary

Blog Floating Button plugin versions up to 1.4.20 contain an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious script without authentication.

Risk Assessment

The risk includes execution of malicious script in the user's browser, potentially leading to data theft or session hijacking.

Recommendation

Update the plugin to a version newer than 1.4.20 that includes a fix for the XSS vulnerability.

Original NVD description (English source)

Unauthenticated Cross Site Scripting (XSS) in Blog Floating Button <= 1.4.20 versions.