Float To Top Button Vulnerabilities

[en] The Float to Top Button WordPress plugin through 2.3.6 does not escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Affected:

up to 2.3.6

Fix:

No patched version reported

Disclosed:

Sep 19, 2022

CVE-2022-2709 on NVD →

The Float to Top Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.3.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web script...

CVSS:

5.5

Affected:

up to 2.3.6

Fix:

No patched version reported

Disclosed:

Aug 23, 2022

CVE-2022-2709 on NVD →

The Float to Top Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters such as 'arrow_img_url' in versions up to, and including, 2.3.6 due to insufficient input sanitization and output escaping that makes attribute based XSS possible. This makes it possible for authenticated at...

CVSS:

5.5

Affected:

up to 2.3.6

Fix:

No patched version reported

Disclosed:

Aug 17, 2022

The Float to Top Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters such as 'arrow_img_url' in versions up to, and including, 2.3.6 due to insufficient input sanitization and output escaping that makes attribute based XSS possible. This makes it possible for authenticated at...

Affected:

up to 2.3.6

Fix:

No patched version reported

Disclosed:

Aug 17, 2022