PT-2026-42393 · WordPress · Wpb Floating Menu & Categories

Barohaf - Fpt · Published 2026-05-21 · Updated 2026-05-21 · CVE-2026-4811

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions WPB Floating Menu & Categories for WordPress – Sticky Side Menu with Icons versions prior to 1.0.9

Description The plugin is subject to Stored Cross-Site Scripting (XSS), a flaw where malicious scripts are permanently stored on the target server. This occurs due to insufficient input sanitization and output escaping in the 'Icon CSS Class' category field. Authenticated attackers with Editor-level access or higher can inject arbitrary web scripts that execute when a user visits the affected page.

Recommendations Update the plugin to a version later than 1.0.8. As a temporary workaround, restrict access to the 'Icon CSS Class' category field for users with Editor-level permissions until the update is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-4811

Affected Products

Wpb Floating Menu & Categories

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-4811 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/961702ff-60fb-41ff-99b0-a37ade051083?source=cve · Note
• https://t.me/cveNotify/164330 · Telegram Post
• https://plugins.trac.wordpress.org/browser/wpb-floating-menu-or-categories/tags/1.0.8/admin/category-icon.php#L41 · Note
• https://t.me/CVEtracker/54455 · Telegram Post