Float Menu Vulnerabilities

The Float menu – awesome floating side menu plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.1.2. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update plugin settings granted they can tr...

CVSS:

4.3

Affected:

up to 6.1.2

Fixed in:

6.1.3

Disclosed:

Mar 27, 2025

CVE-2025-30912 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Float menu allows Cross Site Request Forgery. This issue affects Float menu: from n/a through 6.1.2.

Affected:

up to 6.1.3

Fixed in:

6.1.3

Disclosed:

Mar 27, 2025

CVE-2025-30912 on NVD →

[en] The Float menu WordPress plugin before 6.0.1 does not have CSRF check in its bulk actions, which could allow attackers to make logged in admin delete arbitrary menu via a CSRF attack.

Affected:

up to 6.0.1

Fixed in:

6.0.1

Disclosed:

May 2, 2024

CVE-2024-2405 on NVD →

The Float menu – awesome floating side menu plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.0. This is due to missing or incorrect nonce validation on the float-menu function. This makes it possible for unauthenticated attackers to delete menu items via a forged...

CVSS:

4.3

Affected:

up to 6.0

Fixed in:

6.0.1

Disclosed:

Apr 11, 2024

CVE-2024-2405 on NVD →

[en] The Float menu WordPress plugin before 5.0.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Affected:

up to 5.0.3

Fixed in:

5.0.3

Disclosed:

Jul 10, 2023

CVE-2023-3225 on NVD →

The Float menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 5.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary...

CVSS:

4.4

Affected:

up to 5.0.2

Fixed in:

5.0.3

Disclosed:

Jun 19, 2023

CVE-2023-3225 on NVD →

[en] The Float menu WordPress plugin before 5.0.2, Bubble Menu WordPress plugin before 3.0.4, Button Generator WordPress plugin before 2.3.5, Calculator Builder WordPress plugin before 1.5.1, Counter Box WordPress plugin before 1.2.2, Floating Button WordPress plugin before 5.3.1, Herd Effects WordPress plugin before 5...

Affected:

up to 5.0.2

Fixed in:

5.0.2

Disclosed:

Jun 12, 2023

CVE-2023-2362 on NVD →

Several plugins by Wow-Company are vulnerable to Reflected Cross-Site Scripting via the ‘page’ parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully tri...

CVSS:

6.1

Affected:

up to 5.0.1

Fixed in:

5.0.2

Disclosed:

May 22, 2023

CVE-2023-2362 on NVD →

[en] The Float menu WordPress plugin before 4.3.1 does not have CSRF check in place when deleting menu, which could allow attackers to make a logged in admin delete them via a CSRF attack

Affected:

up to 4.3.1

Fixed in:

4.3.1

Disclosed:

Feb 21, 2022

CVE-2022-0313 on NVD →

The Float menu WordPress plugin before 4.3.1 does not have CSRF check in place when deleting menu, which could allow attackers to make a logged in admin delete them via a CSRF attack

CVSS:

4.3

Affected:

up to 4.3

Fixed in:

4.3.1

Disclosed:

Jan 24, 2022

CVE-2022-0313 on NVD →