CVE-2026-15383 Overview
CVE-2026-15383 is a stored Cross-Site Scripting (XSS) vulnerability in the Blog Floating Button WordPress plugin through version 1.4.20. The plugin fails to sanitize or escape the visitor User-Agent header, which it stores through an unauthenticated tracking REST endpoint. The stored value is later rendered unescaped in an administrator report page. An unauthenticated attacker can inject a malicious script that executes in the session of any administrator who views the access report. Successful exploitation can lead to full site takeover through administrator session compromise. The weakness is categorized under [CWE-79].
Critical Impact
Unauthenticated attackers can store JavaScript payloads that execute with administrator privileges, enabling WordPress site takeover.
Affected Products
- Blog Floating Button WordPress plugin versions through 1.4.20
- WordPress sites exposing the plugin's unauthenticated tracking REST endpoint
- Administrator report pages rendering visitor User-Agent data
Discovery Timeline
- 2026-08-03 - CVE-2026-15383 published to NVD
- 2026-08-03 - Last updated in NVD database
Technical Details for CVE-2026-15383
Vulnerability Analysis
The Blog Floating Button plugin exposes an unauthenticated REST endpoint that records visitor telemetry, including the HTTP User-Agent header. The plugin writes this header value to persistent storage without sanitization or output encoding. When an administrator opens the plugin's access report page in the WordPress dashboard, the stored User-Agent string is rendered directly into the HTML response. Any attacker-controlled script tags or event handlers execute in the administrator's authenticated browser context. This chain converts a passive telemetry field into a persistent XSS delivery vector.
Root Cause
The root cause is missing input sanitization on write and missing output escaping on render. The plugin trusts the User-Agent header verbatim and does not apply WordPress escaping helpers such as esc_html() or wp_kses() before echoing the value into administrator HTML. Combined with an unauthenticated REST endpoint, the flaw allows any anonymous client to seed the payload.
Attack Vector
An attacker sends an HTTP request to the plugin's tracking REST endpoint with a crafted User-Agent header containing JavaScript. No authentication or user interaction on the target site is required to plant the payload. The payload triggers when an administrator subsequently visits the plugin's access or visitor report page. Executing script inherits the administrator session, allowing account creation, plugin installation, or arbitrary content modification. Because the REST endpoint is reachable over the network, exploitation is remote and scalable.
No verified proof-of-concept code is available in public advisories at the time of writing. See the WPScan Vulnerability Report for additional technical detail.
Detection Methods for CVE-2026-15383
Indicators of Compromise
- Requests to the Blog Floating Button plugin's tracking REST route containing <script>, onerror=, onload=, or javascript: substrings inside the User-Agent header.
- Unexpected administrator account creations, plugin installations, or theme edits shortly after an administrator opened the plugin's access report page.
- Outbound HTTP requests from administrator browsers to unfamiliar domains referenced by stored User-Agent payloads.
Detection Strategies
- Inspect web server and WordPress request logs for anomalous User-Agent headers containing HTML or JavaScript syntax targeted at the plugin's REST endpoint.
- Query the plugin's database tables for stored visitor records where the User-Agent field contains angle brackets, quotes, or script keywords.
- Deploy a Content Security Policy in report-only mode on the WordPress admin origin to surface script execution originating from stored telemetry.
Monitoring Recommendations
- Alert on WordPress wp_users inserts or role changes to administrator outside of change windows.
- Monitor for modifications to wp-config.php, active theme files, and the mu-plugins directory following administrator dashboard sessions.
- Track REST API traffic volume and payload size to the Blog Floating Button tracking route to identify scripted abuse.
How to Mitigate CVE-2026-15383
Immediate Actions Required
- Deactivate and remove the Blog Floating Button plugin until a fixed version is confirmed installed.
- Purge stored visitor and access log records created by the plugin to eliminate dormant XSS payloads.
- Rotate administrator credentials and invalidate active sessions in case a payload has already executed.
- Review recently created users, installed plugins, and modified theme files for signs of takeover.
Patch Information
At the time of publication, no fixed release is referenced in the NVD entry beyond noting that versions through 1.4.20 are affected. Monitor the WPScan Vulnerability Report and the plugin's WordPress.org page for a patched version and upgrade immediately when available.
Workarounds
- Block or rate-limit unauthenticated access to the plugin's tracking REST route at the web application firewall.
- Filter inbound requests where the User-Agent header contains HTML tags, event handler attributes, or javascript: schemes.
- Enforce a strict Content Security Policy on /wp-admin/ that disallows inline script execution to blunt stored XSS impact.
# Example ModSecurity rule to block script-bearing User-Agent headers
SecRule REQUEST_HEADERS:User-Agent "@rx (?i)(<script|onerror=|onload=|javascript:)" \
"id:1015383,phase:1,deny,status:403,log,msg:'CVE-2026-15383 Blog Floating Button XSS attempt'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
