CVE-2026-15383

Name of the Vulnerable Software and Affected Versions Blog Floating Button versions prior to 1.4.21

Description The plugin fails to sanitize or escape the visitor User-Agent header. This data is stored via an unauthenticated tracking REST endpoint and subsequently rendered without escaping on an administrator report page. An unauthenticated attacker can store a malicious script that executes within the session of any administrator viewing the access report, potentially resulting in a full site takeover.

Recommendations Update the plugin to version 1.4.21 or later.