Description
The Float menu WordPress plugin before 5.0.2, Bubble Menu WordPress plugin before 3.0.4, Button Generator WordPress plugin before 2.3.5, Calculator Builder WordPress plugin before 1.5.1, Counter Box WordPress plugin before 1.2.2, Floating Button WordPress plugin before 5.3.1, Herd Effects WordPress plugin before 5.2.2, Popup Box WordPress plugin before 2.2.2, Side Menu Lite WordPress plugin before 4.0.2, Sticky Buttons WordPress plugin before 3.1.1, Wow Skype Buttons WordPress plugin before 4.0.2, WP Coder WordPress plugin before 2.5.6 do not escape the page parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Unknown Float menu
Default version status: unaffected
0 to < 5.0.2affected
Unknown Bubble Menu
Default version status: unaffected
0 to < 3.0.4affected
Unknown Button Generator
Default version status: unaffected
0 to < 2.3.5affected
Unknown Calculator Builder
Default version status: unaffected
0 to < 1.5.1affected
Unknown Counter Box
Default version status: unaffected
0 to < 1.2.2affected
Unknown Floating Button
Default version status: unaffected
0 to < 5.3.1affected
Unknown Herd Effects
Default version status: unaffected
0 to < 5.2.2affected
Unknown Popup Box
Default version status: unaffected
0 to < 2.2.2affected
Unknown Side Menu Lite
Default version status: unaffected
0 to < 4.0.2affected
Unknown Sticky Buttons
Default version status: unaffected
0 to < 3.1.1affected
Unknown Wow Skype Buttons
Default version status: unaffected
0 to < 4.0.2affected
Unknown WP Coder
Default version status: unaffected
0 to < 2.5.6affected