54 matches found
Malicious Package
Overview bnpl-blocks-mobile-bnpl-floating-button is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organizatio...
Malicious Package
Overview bnpl-blocks-mobile-bnpl-floating-button is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organizatio...
CVE-2026-28170
Unauthenticated Cross Site Scripting XSS in Blog Floating Button = 1.4.20 versions...
CVE-2026-28170 WordPress Blog Floating Button plugin <= 1.4.20 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Blog Floating Button = 1.4.20 versions...
CVE-2026-28170 WordPress Blog Floating Button plugin <= 1.4.20 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Blog Floating Button = 1.4.20 versions...
EUVD-2026-57955
Unauthenticated Cross Site Scripting XSS in Blog Floating Button = 1.4.20 versions...
CVE-2026-28170
Unauthenticated Cross Site Scripting XSS in Blog Floating Button = 1.4.20 versions...
CVE-2026-28170
CVE-2026-28170 affects the WordPress Blog Floating Button plugin, versions
WordPress Blog Floating Button plugin <= 1.4.20 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by hivesec in WordPress Plugin Blog Floating Button versions = 1.4.20...
PT-2026-71521
Unauthenticated Cross Site Scripting XSS in Blog Floating Button = 1.4.20 versions...
CVE-2026-28170: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Blog Floating Button = 1.4.20 versions...
Malicious code in bnpl-blocks-mobile-bnpl-floating-button (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be8101254611004c84932cd102d4fb71dc7e692d67696df081e66bd37ba3088b On require, index.js loads support.js whose top-level main downloads a platform-specific binary from author-controlled hosts assembled via string-arr...
CVE-2026-15383
The Blog Floating Button WordPress plugin through 1.4.20 does not sanitize or escape the visitor User-Agent header, which it stores through an unauthenticated tracking REST endpoint and later renders unescaped in an administrator report page. This allows an unauthenticated attacker to store a...
CVE-2026-15383 Blog Floating Button <= 1.4.20 - Unauthenticated Stored XSS via User-Agent Header
The Blog Floating Button WordPress plugin through 1.4.20 does not sanitize or escape the visitor User-Agent header, which it stores through an unauthenticated tracking REST endpoint and later renders unescaped in an administrator report page. This allows an unauthenticated attacker to store a...
EUVD-2026-52174
The Blog Floating Button WordPress plugin through 1.4.20 does not sanitize or escape the visitor User-Agent header, which it stores through an unauthenticated tracking REST endpoint and later renders unescaped in an administrator report page. This allows an unauthenticated attacker to store a...
CVE-2026-15383
The Blog Floating Button WordPress plugin, version 1.4.20 and below , is vulnerable to unauthenticated stored XSS . The flaw exists because the plugin fails to sanitize or escape the visitor User-Agent header, which is accepted through an unauthenticated tracking REST endpoint. This malicious inp...
CVE-2026-15383 Blog Floating Button <= 1.4.20 - Unauthenticated Stored XSS via User-Agent Header
The Blog Floating Button WordPress plugin through 1.4.20 does not sanitize or escape the visitor User-Agent header, which it stores through an unauthenticated tracking REST endpoint and later renders unescaped in an administrator report page. This allows an unauthenticated attacker to store a...
CVE-2026-15383: Improper Neutralization of Input During Web Page Generation
The Blog Floating Button WordPress plugin through 1.4.20 does not sanitize or escape the visitor User-Agent header, which it stores through an unauthenticated tracking REST endpoint and later renders unescaped in an administrator report page. This allows an unauthenticated attacker to store a...
PT-2026-67072
The Blog Floating Button WordPress plugin through 1.4.20 does not sanitize or escape the visitor User-Agent header, which it stores through an unauthenticated tracking REST endpoint and later renders unescaped in an administrator report page. This allows an unauthenticated attacker to store a...