Unescaped User-Agent Vulnerability in Blog Floating Button Plugin by WordPress
CVE-2026-15383
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 3 August 2026
Badges
What is CVE-2026-15383?
The Blog Floating Button WordPress plugin prior to version 1.4.20 suffers from a vulnerability where the visitor User-Agent header is not properly sanitized or escaped. This weakness allows an unauthenticated attacker to inject malicious scripts through a tracking REST endpoint. The exploited script is stored and subsequently displayed unescaped in an administrator report page. This presents a significant risk, as any administrator who accesses the report can have the malicious script executed within their session, potentially leading to unauthorized control of the site.
Affected Version(s)
Blog Floating Button 0 <= 1.4.20
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.