The Blog Floating Button WordPress plugin through version 1.4.20 contains a stored Cross-Site Scripting (CWE-79) vulnerability. It does not properly sanitize or escape the User-Agent HTTP header submitted by visitors. This header is stored through an unauthenticated REST endpoint used for tracking and is later displayed without escaping in an administrator report page. An attacker can exploit this by submitting a malicious User-Agent string, which gets stored and then executed in the browser session of any administrator who views the report page, enabling script execution and potential site compromise.

An unauthenticated attacker can inject malicious JavaScript that executes in the context of an administrator's session when they view the access report page. This can lead to site takeover by allowing the attacker to perform actions with administrator privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid viewing the affected report page or restrict access to trusted users only. Monitor official vendor channels for updates and apply patches promptly once released.