CVE-2026-15383

The CVE-2026-15383 issue affects the Blog Floating Button WordPress plugin up to version 1.4.20. It does not sanitize or escape the visitor User-Agent header, storing it via an unauthenticated tracking REST endpoint and later rendering it unescaped in an administrator report page. This enables an...