The “Float to Top Button” is a popular WordPress plugin designed to add a convenient scroll-to-top button to websites, enhancing user experience. However, a significant security flaw has been discovered in versions up to and including 2.3.6. This vulnerability, identified as a Stored Cross-Site Scripting (XSS) issue, could allow attackers with high-level access, such as administrators, to inject harmful code into your website. What makes this particularly concerning is that the attack could occur even when WordPress’s built-in `unfiltered_html` capability is restricted, a common security measure in multi-site installations.<\/p>\n
In simple terms, certain settings within the plugin do not properly clean up user-supplied data. If a malicious administrator (or an attacker who has compromised an admin account) inputs harmful scripts into these settings, the scripts get saved. When someone else views these affected settings pages, the malicious code executes in their browser. This could lead to various attacks, including stealing session cookies, defacing the website, or redirecting users to malicious sites.<\/p>\n
Product:<\/strong> Float to Top Button WordPress Plugin The Stored Cross-Site Scripting vulnerability impacts the following versions of the Float to Top Button WordPress plugin:<\/p>\n If you are using any of these versions, your website is potentially at risk.<\/p>\n This vulnerability has been thoroughly analyzed. As of the latest information, there is no official patch or updated version available to fix this specific issue within the Float to Top Button plugin. This means users of affected versions remain exposed to the risk of XSS attacks.<\/p>\n Rated as “Medium” severity with a CVSS Score of 4.8, this vulnerability poses a notable threat. While it requires high-privilege access (like an administrator account) to exploit, the impact can be significant. Stored XSS attacks can compromise user sessions, lead to website defacement, or facilitate further malicious activities on the affected site. In a multi-site environment, where `unfiltered_html` is often disabled to prevent such injections, this bypass makes the vulnerability even more critical.<\/p>\n Given that no direct fix or patch has been released for the Float to Top Button plugin (as indicated by the “No known fix” status), immediate action is crucial to protect your WordPress site:<\/p>\n Regular security audits of your WordPress plugins and themes are always recommended to minimize exposure to such vulnerabilities.<\/p>\n https:\/\/wpscan.com\/vulnerability\/1c551234-9c59-41a0-ab74-beea2d27df6b<\/p>\n https:\/\/wpscan.com\/vulnerability\/1c551234-9c59-41a0-ab74-beea2d27df6b<\/p>\n","protected":false},"excerpt":{"rendered":" The “Float to Top Button” is a popular WordPress plugin designed to add a convenient scroll-to-top button to websites, enhancing user experience. However, a significant security flaw has been discovered in versions up to and including 2.3.6. This vulnerability, identified as a Stored Cross-Site Scripting (XSS) issue, could allow attackers with high-level access, such as […]<\/p>\n","protected":false},"author":17,"featured_media":2545,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[1001,755,746,726,692],"class_list":["post-3310","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-float-to-top-button","tag-plugin-security","tag-website-security","tag-wordpress","tag-xss"],"blocksy_meta":[],"yoast_head":"\n
\nCVE ID:<\/strong> CVE-2022-2709
\nPublished Date:<\/strong> September 19, 2022
\nSeverity:<\/strong> Medium (CVSS Score 4.8)
\nStatus:<\/strong> Analyzed<\/p>\nAffected Products<\/h2>\n
\n
Current Status<\/h2>\n
Severity Level<\/h2>\n
Possible Solutions<\/h2>\n
\n
References<\/h2>\n