This vulnerability is an unauthenticated cross-site scripting (XSS) issue in Blog Floating Button versions <= 1.4.20. It allows attackers to inject malicious scripts without requiring authentication, which can execute in the victim's browser. The CVSS score of 7.1 reflects network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. No official fix or patch information is provided in the available data.

Successful exploitation can lead to partial compromise of confidentiality, integrity, and availability of affected systems or user sessions due to script execution in the victim's browser context. This may allow attackers to steal sensitive information, manipulate content, or disrupt service availability to some extent.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider applying web application firewall (WAF) rules or input validation controls to mitigate potential exploitation. Monitor vendor channels for updates on official patches or workarounds.