Answer in brief
CVE-2026-15383 records a Medium severity (CVSS 6.1) vulnerability in Blog Floating Button <= 1.4.20 - Unauthenticated Stored XSS via User-Agent Header. The current sources do not mark it as known exploited. The current feed maps Unknown/Blog Floating Button (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Unknown/Blog Floating Button (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Unknown/Blog Floating Buttongeneric | 0 | Not reported |
Published upstream
Aug 3, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 3, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 3, 2026
The Blog Floating Button WordPress plugin through 1.4.20 does not sanitize or escape the visitor User-Agent header, which it stores through an unauthenticated tracking REST endpoint and later renders unescaped in an administrator report page. This allows an unauthenticated attacker to store a malicious script that executes in the session of any administrator who views the access report, leading to site takeover.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-15383 records a Medium severity (CVSS 6.1) vulnerability in Blog Floating Button <= 1.4.20 - Unauthenticated Stored XSS via User-Agent Header. The current sources do not mark it as known exploited. The current feed maps Unknown/Blog Floating Button (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Unknown/Blog Floating Button (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Unknown/Blog Floating Buttongeneric | 0 | Not reported |
Published upstream
Aug 3, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 3, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 3, 2026
The Blog Floating Button WordPress plugin through 1.4.20 does not sanitize or escape the visitor User-Agent header, which it stores through an unauthenticated tracking REST endpoint and later renders unescaped in an administrator report page. This allows an unauthenticated attacker to store a malicious script that executes in the session of any administrator who views the access report, leading to site takeover.
Quoted source text, attributed separately from HOL analysis.