26 matches found
CVE-2026-28170
Unauthenticated Cross Site Scripting XSS in Blog Floating Button = 1.4.20 versions...
CVE-2026-28170 WordPress Blog Floating Button plugin <= 1.4.20 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Blog Floating Button = 1.4.20 versions...
CVE-2026-28170 WordPress Blog Floating Button plugin <= 1.4.20 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Blog Floating Button = 1.4.20 versions...
EUVD-2026-57955
Unauthenticated Cross Site Scripting XSS in Blog Floating Button = 1.4.20 versions...
CVE-2026-28170
Unauthenticated Cross Site Scripting XSS in Blog Floating Button = 1.4.20 versions...
CVE-2026-28170
CVE-2026-28170 affects the WordPress Blog Floating Button plugin, versions
WordPress Blog Floating Button plugin <= 1.4.20 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by hivesec in WordPress Plugin Blog Floating Button versions = 1.4.20...
PT-2026-71521
Unauthenticated Cross Site Scripting XSS in Blog Floating Button = 1.4.20 versions...
CVE-2026-28170: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Blog Floating Button = 1.4.20 versions...
CVE-2026-15383
The Blog Floating Button WordPress plugin through 1.4.20 does not sanitize or escape the visitor User-Agent header, which it stores through an unauthenticated tracking REST endpoint and later renders unescaped in an administrator report page. This allows an unauthenticated attacker to store a...
CVE-2026-15383 Blog Floating Button <= 1.4.20 - Unauthenticated Stored XSS via User-Agent Header
The Blog Floating Button WordPress plugin through 1.4.20 does not sanitize or escape the visitor User-Agent header, which it stores through an unauthenticated tracking REST endpoint and later renders unescaped in an administrator report page. This allows an unauthenticated attacker to store a...
EUVD-2026-52174
The Blog Floating Button WordPress plugin through 1.4.20 does not sanitize or escape the visitor User-Agent header, which it stores through an unauthenticated tracking REST endpoint and later renders unescaped in an administrator report page. This allows an unauthenticated attacker to store a...
CVE-2026-15383
The Blog Floating Button WordPress plugin, version 1.4.20 and below , is vulnerable to unauthenticated stored XSS . The flaw exists because the plugin fails to sanitize or escape the visitor User-Agent header, which is accepted through an unauthenticated tracking REST endpoint. This malicious inp...
CVE-2026-15383 Blog Floating Button <= 1.4.20 - Unauthenticated Stored XSS via User-Agent Header
The Blog Floating Button WordPress plugin through 1.4.20 does not sanitize or escape the visitor User-Agent header, which it stores through an unauthenticated tracking REST endpoint and later renders unescaped in an administrator report page. This allows an unauthenticated attacker to store a...
CVE-2026-15383: Improper Neutralization of Input During Web Page Generation
The Blog Floating Button WordPress plugin through 1.4.20 does not sanitize or escape the visitor User-Agent header, which it stores through an unauthenticated tracking REST endpoint and later renders unescaped in an administrator report page. This allows an unauthenticated attacker to store a...
PT-2026-67072
The Blog Floating Button WordPress plugin through 1.4.20 does not sanitize or escape the visitor User-Agent header, which it stores through an unauthenticated tracking REST endpoint and later renders unescaped in an administrator report page. This allows an unauthenticated attacker to store a...
EUVD-2023-31221
Malicious code in bioql PyPI...
CVE-2023-27445
Cross-Site Request Forgery CSRF vulnerability in Meril Inc. Blog Floating Button plugin = 1.4.12 versions...
