CVE-2023-2362: The Float menu WordPress plugin before 5.0.2, Bubble Menu WordPress plugin before 3.0.4, Button Generator WordPress plugin before 2.3.5, Calculator Builder…

PriorityP424medium6.1CVSS 3.1

AVNACLPRNUIRSCCLILAN

EPSS

0.46%

36.4th percentile

The Float menu WordPress plugin before 5.0.2, Bubble Menu WordPress plugin before 3.0.4, Button Generator WordPress plugin before 2.3.5, Calculator Builder WordPress plugin before 1.5.1, Counter Box WordPress plugin before 1.2.2, Floating Button WordPress plugin before 5.3.1, Herd Effects WordPress plugin before 5.2.2, Popup Box WordPress plugin before 2.2.2, Side Menu Lite WordPress plugin before 4.0.2, Sticky Buttons WordPress plugin before 3.1.1, Wow Skype Buttons WordPress plugin before 4.0.2, WP Coder WordPress plugin before 2.5.6 do not escape the page parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Affected

12 ranges

Vendor	Product	Version range	Fixed in
wow-company	bubble_menu	< 3.0.4	3.0.4
wow-company	button_generator	< 2.3.5	2.3.5
wow-company	calculator-builder	< 1.5.1	1.5.1
wow-company	counter_box	< 1.2.2	1.2.2
wow-company	float_menu	< 5.0.2	5.0.2
wow-company	floating_button	< 5.3.1	5.3.1
wow-company	herd_effects	< 5.2.2	5.2.2
wow-company	popup_box	< 2.2.2	2.2.2
wow-company	side_menu_lite	< 4.0.2	4.0.2
wow-company	sticky_buttons	< 3.1.1	3.1.1
wow-company	wow_skype_buttons	< 4.0.2	4.0.2
wow-company	wp_coder	< 2.5.6	2.5.6

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.