CyberRota Analysis
AI-GeneratedThe Blog Floating Button WordPress plugin versions up to 1.4.20 is vulnerable due to improper sanitization of the visitor User-Agent header, allowing unauthenticated attackers to inject malicious scripts. This vulnerability can lead to session hijacking of administrators when they view the access report, potentially resulting in full site takeover. WordPress site administrators using this plugin should prioritize patching or disabling it to mitigate the risk.
Original NVD Description
The Blog Floating Button WordPress plugin through 1.4.20 does not sanitize or escape the visitor User-Agent header, which it stores through an unauthenticated tracking REST endpoint and later renders unescaped in an administrator report page. This allows an unauthenticated attacker to store a malicious script that executes in the session of any administrator who views the access report, leading to site takeover.