Threats tagged 'ghsa-xrmq-hv4r-5262'

CVE-2026-28170 is an unauthenticated cross-site scripting (XSS) vulnerability affecting Blog Floating Button versions up to and including 1.4.20. This vulnerability allows an attacker to inject malicious scripts that can execute in the context of a user's browser, potentially leading to partial confidentiality, integrity, and availability impacts. The vulnerability has a CVSS v3.1 score of 7.1, indicating high severity. No patch or remediation information is currently available.