Threats tagged 'ghsa-r7c9-cm4j-g8qq'

CVE-2026-15383 is a Cross-Site Scripting (XSS) vulnerability in the Blog Floating Button WordPress plugin up to version 1.4.20. The plugin fails to sanitize or escape the visitor User-Agent header, which is stored via an unauthenticated tracking REST endpoint and later rendered unescaped in an administrator report page. This allows an unauthenticated attacker to inject malicious scripts that execute in the context of any administrator viewing the report, potentially leading to site takeover.