Blog Floating Button

Blog Floating Button has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2026; 2 are fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 6.2, and the most serious one scores 7.2 out of 10. Severity breakdown: 0 critical and 2 high. 2026 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Scripting, behind 2 of the records (67%). Other recurring categories include Cross-Site Request Forgery (CSRF).

2 of the records (67%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2026.

3 independent researchers contributed these findings, one record each. Blog Floating Button is installed on roughly 9,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSMedium
6.2/ 10
Patch Coverage67%
Open

1

Fixed

2

Get automatic notifications for all Blog Floating Button vulnerabilities before they are exploited.

Most severe open issueCVSS 7.2CVE-2026-15383

Blog Floating Button <= 1.4.20 - Unauthenticated Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

3 records
Blog Floating Button banner
Latestv1.4.21

Blog Floating Button

1meril

Author

1meril

5.0(1)
100/100
Last Updated
2026-07-31 (1mo ago)
Active Installs
9,000+
Downloads
81,491
Requires WP
6.0+
Requires PHP
8.2+
Tested up to
WP 7.0.4
Created
2020-04-14 (7y ago)

Blog Floating Button (BFB) makes it easy to add floating buttons to your WordPress site. Use them to guide visitors to landing pages, such as product or contact pages, and encourage purchases or inquiries. From the WordPress admin area, you can change the button text and choose from four button styles and five colors. This makes it easy to create a prominent floating button that matches your site’s design. How to Use General Settings Configure the settings shared by all floating buttons. Development mode: Select “Show only to administrators” to display floating buttons only to users logged in as administrators. This is useful during initial setup. Select “Show to everyone” when you are ready to display them to all visitors. Desktop button design: Choose the button design shown to visitors using desktop computers. Mobile button design: Choose the button design shown to visitors using mobile devices. Homepage display: Choose how floating buttons appear on the homepage. Excluded post IDs: Floating buttons are hidden on posts and pages with the specified IDs. Enter the IDs of pages where you do not want a button to appear, such as a contact page. Auto-hide: Automatically hide floating buttons when a visitor scrolls the page. Select “Always show” to turn off auto-hide. Enable click tracking: Choose whether to track button clicks. Exclude administrators from click tracking: Choose whether to track clicks from users logged in as administrators. For more accurate data, excluding administrators is recommended except during testing. PRO version license key: Enter a paid PRO version license key to unlock additional features. Button Settings Configure each floating button individually. Button type: Choose the button shape. Button color: Change the button color. Button text: Set the text displayed on the button. Destination URL: Set the URL that opens when a visitor clicks the button. Link behavior: Choose how the link opens. Select “New tab” to open it in a separate browser tab. Background color: Change the color of the bar behind the button. This plugin bundles the Montserrat font (SIL Open Font License 1.1). See css/fonts/OFL.txt for the full license text.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C