This vulnerability arises from the Blog Floating Button WordPress plugin storing the visitor User‑Agent header without proper sanitization. The unsanitized input is later rendered unescaped in an administrator‑only report page, allowing an attacker to inject arbitrary JavaScript. When an administrator views the report, the malicious script runs in their browser session, enabling credential theft or full site compromise. The weakness is a classic Stored Cross‑Site Scripting flaw (CWE‑79).

WordPress installations using the Blog Floating Button plugin version 1.4.20 or earlier are affected. Administrators with access to the plugin’s access report page are the direct target. The issue is present on any server that actively runs this plugin version and exposes the REST endpoint used for tracking.

The exploit is simple: craft a malicious User‑Agent header, send it to the tracking endpoint, then coerce an administrator into opening the access report page, where the injected script will execute in their administrator session. Given the lack of an official patch yet, the risk remains high for any site running the affected plugin version.